What this tool checks
The checker resolves the hostname, opens a genuine TLS handshake on port 443 (or whatever port you append), and reports the certificate the server actually presented — sending your hostname as the SNI value so a shared host selects the right virtual host. It reads the subject and issuer common names, the notBefore and notAfter dates, the days remaining, every hostname in the subject alternative name extension, the negotiated protocol and cipher, the serial number and SHA-256 fingerprint, and walks the issuing chain above the leaf. It deliberately does not refuse to report on an untrusted certificate: an expired or self-signed cert is exactly the thing you came here to see, so the verdict is shown rather than turned into an error.
Why certificate expiry keeps taking sites down
Certificate outages are almost never a security failure — they are a calendar failure. Let's Encrypt certificates live 90 days and are meant to renew automatically, which works until the renewal cron silently stops, the ACME challenge path gets blocked by a new redirect rule, or the certificate moves behind a CDN that holds its own copy. Commercial certificates last a year and fail differently: the renewal reminder goes to an inbox belonging to someone who left. Either way the first symptom is the same, and it is not a warning email — it is a full-screen browser interstitial that turns away every visitor at once.
The industry is also shortening lifetimes hard: the maximum certificate validity is on a path toward roughly 47 days by 2029. Any process that depends on a human remembering will break. Automation plus monitoring is the only combination that survives.
How to fix what you find
Expiring soon: renew now rather than at the deadline — if renewal is automated, force a dry run and confirm it actually writes a new certificate, because a renewal that fails quietly looks identical to one that never ran. Hostname mismatch: reissue with both the apex and www in the SAN list, or fix the redirect so visitors only reach the covered name. Chain not trusted: the server is usually missing the intermediate certificate — browsers on desktop often paper over this from cache while mobile clients fail hard, which is why it can look like an intermittent bug. Serve the full chain. Certificate fine but the site still warns: look for mixed content — a single http:// script on an HTTPS page downgrades the padlock.