What we checkCertificate & HTTPSTL-02
Certificate is valid and trusted
The certificate your server presents must chain to a trusted root and not be expired or self-signed.
- Check
- TL-02
- Included
- Free in every scan
What we check
We read the certificate chain from the handshake and check the leaf's dates, its issuer, and whether the chain completes.
Why it matters
An untrusted certificate produces a full-page browser interstitial. Most visitors leave; the ones who click through have been trained to ignore exactly the warning that matters.
This is the one certificate problem that caps your grade at D on its own, because it is the one your visitors cannot avoid seeing.
Certificate problems are also the ones that get worked around rather than fixed: an internal tool with a self-signed certificate teaches a team to click through the warning, and that habit does not stay inside the tool.
How to fix it
- 1
Expired: renew it, and find out why the automatic renewal did not.
- 2
Untrusted issuer: you are serving a self-signed certificate, usually left over from a staging setup.
- 3
Incomplete chain: your server is not sending the intermediate certificate. Most tooling calls this the 'fullchain' file.
Common questions
- It works in Chrome but you say the chain is incomplete.
- Chrome can sometimes fetch a missing intermediate itself; other clients — Android, curl, most API libraries — cannot. Serve the full chain.
- Why does an expired certificate cap the grade at D?
- Because it takes the site down for every visitor. No amount of good configuration elsewhere makes a page nobody can open into a passing grade.
- Do you check revocation?
- No. Revocation checking is unreliable in practice and browsers have largely moved to their own push-based lists.
See how your domain does on this check.
All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.