See when a certificate expires, which addresses it covers and whether browsers and email apps trust it. If something is wrong, we tell you how to fix it.
Port 443 is already filled in for websites; change it for email and other services. It takes a few seconds.
Everything a browser checks, plus server settings: old TLS versions and the switch from http to https.
A certificate is issued for specific addresses. If the address a visitor opens isn’t in it, the browser shows a warning. A certificate for example.com doesn’t cover mail.example.com unless that name is listed separately or through a wildcard: *.example.com.
We show the expiration date and how many days are left. Free certificates last a few months and renew automatically. If renewal breaks, you see it here in advance, not on the day the site stops opening.
A website certificate is signed by an intermediate certificate, and that one by a root certificate already built into browsers and phones. That is the chain. The server must send all of it except the root, or some devices won’t trust the certificate.
Four reasons a browser or email app warns about an insecure connection.
The server sends only its own certificate, without the intermediate. Add the intermediate certificate file to the server settings; the certificate authority provides it with the certificate. It is often called CA bundle or chain.
For example, it covers example.com while the site opens at www.example.com. Or the server shows the hosting provider’s certificate instead of yours. Get a certificate that lists every address you need and install it for this site.
A paid certificate wasn’t renewed, or automatic renewal of a free one stopped working. Renew or reissue the certificate and install it on the server.
The server created it itself, not a certificate authority, so browsers don’t trust it. This often happens right after a server or mail system is set up. A website or mailbox that people use needs a certificate from a certificate authority.
Take the server and port from your email app’s settings. The certificate is checked just like a website’s.
In the settings this is the “outgoing mail server”. On port 465 encryption starts right away (apps call it SSL/TLS). On port 587 the connection starts unencrypted and switches to encryption with the STARTTLS command.
This is the “incoming mail server”. IMAP keeps messages on the server, so they show up on every device: port 993, or 143 with STARTTLS. POP3 downloads messages to one computer: port 995 or 110.
Other mail servers deliver messages on port 25. The address of that server is in the domain’s DNS, in the MX record. If you enter the domain itself and it has no server of its own, we show the servers from MX.
Why a browser shows an error when the certificate looks fine, and how to check email.
Almost always the server doesn’t send the intermediate certificate. A desktop browser often completes the chain itself: it downloads the missing certificate from a link inside the site’s certificate or remembers it from other sites. Many phones, email apps and payment services can’t do that, so only some visitors see the error. Our check connects as a fresh client without that memory and will show “Missing intermediate certificate”.
The new file is on the server, but the server hasn’t picked it up yet: after replacing a certificate, restart the web server or mail server. The second common reason is a CDN, a network like Cloudflare that serves the site to visitors from its own servers. In that case the certificate visitors see is set up in the CDN. We don’t store results; every check connects to the server again.
In your email app’s settings, under incoming and outgoing mail: they list the server, for example mail.example.com, the port and the encryption type. If you don’t have the app at hand, the address and ports are usually in your email service’s instructions or in the hosting panel where the mailbox was created.
The server sent a certificate the browser no longer needs: the chain reached a trusted root earlier. Usually it’s an old root certificate kept for compatibility with older devices. It isn’t an error, but you can remove it from the chain file.
No. Certificates are issued for names, so we check by name. We don’t check servers in internal networks: our server doesn’t connect to private networks, even if a name points there. You can check a server in your own network with an OpenSSL command from any computer in that network: openssl s_client -connect mail.example.com:993 -servername mail.example.com -showcerts.
Renew a paid certificate two to three weeks ahead: the certificate authority needs time to validate the domain again, and you need time to install the new file. A free one usually renews itself about a month before it expires. If less than two weeks are left and the certificate hasn’t been updated, automatic renewal has failed. You can order a certificate for a new term from us.
No. The check answers whether a website or mailbox will open without warnings: addresses, expiry, chain, trust, TLS versions and the switch to https. Certificate revocation, the full cipher list and vulnerabilities like Heartbleed are covered by full server audit services such as SSL Labs. That kind of check takes a few minutes.
On our hosting a free website certificate comes with the plan and installs and renews itself.
If yours has expired, lists the wrong address or is self-signed, order a new one: single-domain or Wildcard, from Sectigo and RapidSSL. Reissuing with a new key is part of the service.
