What this check inspects
Shipwork opens a TLS connection to the host and reads the peer certificate directly. It checks whether the subject alternative names cover the host, how many days remain before expiry, whether the chain validates, and which TLS protocol was negotiated. It flags coverage below fourteen days as an error and below thirty days as a warning.
What a failure means
Not covering the host, being expired, or failing chain validation are all errors, because browsers and crawlers will refuse the connection. Expiry within twenty eight days is a warning to renew. An old negotiated TLS version is a warning.
How to fix it
- Include both the apex and the www host in the certificate or its subject alternative names.
- Renew before expiry, and make sure automatic renewal is actually running rather than merely configured.
- Serve the full chain, including intermediates, so clients do not have to guess.
- Disable TLS 1.0 and 1.1 so modern protocols are the only option.
A typical failure, worked through
The setupA store moves to a new host and issues a certificate for www.example.com only, while its canonical tags and sitemap use https://example.com.
What the check reportsThe check reports that the certificate does not cover example.com. Visitors who type the domain see a warning, and crawlers following the canonical can refuse the connection.
The pointThe host in your canonical and the host on your certificate have to be the same one. Test the exact host you tell crawlers to use.