Is your TLS certificate healthy?
An expired or wrong-host certificate blocks browsers and crawlers alike, and it is invisible until it bites. This opens a real TLS connection and reads the certificate: issuer, expiry, host coverage and chain validity.
Opens a real TLS connection to the host from the server. Nothing is stored.
How this check works
Shipwork connects to the host on 443, reads the certificate, and reports whether it covers the hostname, how many days until it expires, the negotiated protocol and cipher, and whether the chain validated. It flags an expired, soon-to-expire or wrong-host certificate.
What the TLS certificate check reads
The check opens a TLS connection to your host on port 443 and reads the certificate the server presents. It records the subject and issuer, the validity window, the names in the subject alternative name list, the negotiated protocol and cipher, and whether the chain validated. It does not rely on a page request failing; it inspects the handshake directly.
It then tests host coverage: the certificate is accepted if it lists the exact hostname or a wildcard that matches it at the same number of labels. It reports days remaining, flagging 14 days or fewer as an error and 30 days or fewer as a warning. The probe has an eight-second timeout and reads the certificate even when the chain would fail.
How to read the certificate result
A healthy result means the certificate covers your hostname, has days remaining and the chain validated. That is what lets browsers and crawlers connect without a warning. Days remaining is a snapshot at the moment of the check, so a valid certificate that expires soon still needs renewal.
A host-coverage error means the presented certificate does not list the name you checked, which is common when a certificate covers the apex but not www or a subdomain. An expired or soon-to-expire finding is an outage waiting to happen. A chain error means the intermediate certificates were not trusted. An old negotiated protocol is a warning, and the cipher it saw is reported.
Common causes and why they matter for search
Automatic renewal can fail silently, especially after a DNS, proxy or hosting change, and the first symptom is the whole site failing for visitors and crawlers at once. A certificate issued for the wrong name, or a wildcard that does not match a deeper subdomain, produces a browser warning that stops people before they arrive.
HTTPS is a light ranking signal, but a certificate error is far worse than a missing signal: it blocks access. For a store, an expired certificate also breaks checkout, feeds and email links. A certificate can look fine on the owner's machine if the browser cached an old state, which is why an external check matters.
How to fix certificate problems
If the certificate does not cover the host, issue one that does or add the name to the certificate. If renewal failed, check the automation, the challenge records and any proxy or firewall change. If the chain is incomplete, configure the server to send the intermediate certificates. Keep the renewal window generous so a failed attempt has time to be retried.
On a managed platform, renewal is usually automatic; confirm it is enabled and that no custom domain or proxy is interfering. On a self-managed host, monitor the expiry rather than trusting the calendar. After any DNS or content delivery change, reconnect and check the certificate that is actually served.
When to use related security checks
Use security headers for HSTS and the rest, and DNS check when a certificate or routing problem follows a DNS change. Use redirect check to confirm HTTP still moves visitors to HTTPS.
For the wider picture, the site audit covers delivery, and the free website audit checklist puts the certificate in context with the other checks.
Questions
How often do certificates expire?
What is host coverage?
Does TLS affect SEO?
How do I check my TLS certificate?
What does host coverage mean?
Why does my certificate not cover www?
Does an expired certificate hurt SEO?
Keep reading
What this reads
- Reads the certificate a browser actually receives for your host.
- Reports the expiry date and the names the certificate covers.
- Checks whether the certificate matches the host you asked about.
Cool, just ran an audit and got some insights! Let’s see if I can fix them :)
Whoah! this site is crazy, nothing to roast at all
cool as heck, tried it on my blog and the insights it gave are helpful and not bluff.