What the check reads
The certificate comes from a live TLS handshake with the domain you enter, the same exchange a browser performs before it shows a page. The result is the certificate’s expiry date (its notAfter field) and the whole days left from now. An expired certificate is shown with the date it stopped being valid.
The flag at 30 days is the same threshold the full scan treats as late, so the free result and a client report never disagree about the same certificate. The full scan then raises the severity again at 14 and at 7 days.
What one check does not prove
- It reads the host you enter and does not follow redirects. If visitors land on
wwwor on another host, check that one too. - It covers one certificate. Subdomains, mail servers and APIs can have their own, with their own dates.
- A CDN or proxy in front of the site presents its own certificate, and that is the one the check reads.
- The free check reports the expiry date. Who issued the certificate, which names it covers and whether it signed itself are reported by the full scan on a verified domain.
When the date is close
- Find what renews the certificate: a hosting panel, a CDN, or an ACME client such as Certbot running on the server.
- Check that it last succeeded. Automatic renewal fails quietly when the DNS or HTTP validation it relies on has moved.
- After renewing, make sure the server serves the new certificate: some need a reload before they present it.
- Run the check again and confirm the new date.
Read next
- Certificate expiry monitoringAlerts at 30, 14 and 7 days for every client site.
- What the free check includesCertificate, headers, email policies, cookie flags and public files.
- Security headers checkThe six response headers and what a missing one allows.