Check results and statuses
Each domain on the dashboard has one status, worked out from its latest certificate check. This page explains each status and the fields behind it.
Statuses
| Status | Means | What to do |
|---|---|---|
| Healthy | Valid, trusted chain, hostname matches, not revoked, more than 30 days left | Nothing |
| Renewing | Valid but 30 days or fewer left | Usually nothing: automated renewals happen in this window. You are alerted if it fails. |
| Attention | Expired, 7 days or fewer left, revoked, chain incomplete, or hostname not covered | Fix now; see the field that failed below |
| Error | The check could not complete: no TLS on the port, DNS failure or timeout | Check the hostname and port, then Recheck |
| Pending | Added, first check not finished | Wait for the next run or press Recheck |
Certificate fields
| Field | What it shows | When it is a problem |
|---|---|---|
| Expiry | Not-after date and days remaining | 7 days or fewer, or past |
| Issuer | The certificate authority that signed it | Unexpected CA, which can mean a CDN or proxy is serving its own certificate |
| Chain | Leaf → intermediate → root, each with its name and validity | An intermediate is missing; some clients will reject the certificate |
| Hostname match | Whether the hostname is in the certificate's subject alternative names | Not listed: browsers show a name-mismatch error |
| Revocation | OCSP status, with CRL as fallback: good, revoked or unknown | Revoked. Unknown means the CA could not be reached and is not an error on its own |
| Key and signature | Key type and size (e.g. RSA 2048, ECDSA P-256) and signature algorithm | RSA under 2048 bits or a SHA-1 signature |
| Fingerprint and serial | SHA-256 fingerprint and serial number | A changed fingerprint means a new certificate; this is how renewals are detected |
The free SSL checker shows the same fields for any host, which is useful to confirm a fix before the next daily run.
Common fixes
- Chain incomplete: configure the server with the full chain file your CA provides (for nginx,
ssl_certificateshould point at the fullchain file, not the leaf certificate alone). - Hostname mismatch: reissue the certificate with the hostname in its SANs, or check the DNS points at the server you expect.
- Expired but renewed: the new certificate was issued but not deployed. Reload the web server or push it to the load balancer, then press Recheck.
Domain expiry and DNS columns
Domain expiry is the registration end date from the registry over RDAP (WHOIS for country-code domains without RDAP). Some registries do not publish it; the column then says so. Read more in what happens when a domain expires.
DNS is OK when the hostname has at least one A, CNAME or MX record, and missing when it resolves to nothing.
Last updated