Security 6 min read
SSL certificate checks: expiry, SANs and the mistakes that cause outages
Most certificate outages are predictable: a renewal did not deploy, a hostname was missing from the SAN list, or an intermediate certificate was not served. None of these requires a sophisticated attacker; they require a checklist that nobody ran.
Certificate Transparency logs record publicly trusted certificates. Searching them shows what was issued for a domain, including certificates you did not deploy. That is useful evidence, but it is not the same as inspecting the certificate the server is serving right now.
A pre-renewal checklist
List every hostname that must be covered, including apex, www, API and staging if it is public. Confirm the certificate's SAN entries match that list. Check the chain includes the intermediates clients need, not just the leaf.
Automate a reminder at 30, 14 and 7 days before expiry. Manual calendars fail when the person who set them changes team.
- All production hostnames present in SAN
- Chain complete, including intermediates
- Private key not reused across unrelated services
- Renewal automation tested in staging
- Monitoring alerts before expiry, not after
What CT logs can and cannot tell you
CT logs are append-only records of certificates. A lookup can reveal a certificate issued for your domain by an unexpected authority, which is worth investigating. It can also show the most recent expiry date recorded for a hostname.
Logs do not guarantee that a particular certificate is currently installed, nor do they show the exact chain a client receives. For that, make a TLS connection to the host and inspect the handshake.
Beyond the padlock
A valid certificate encrypts the connection and authenticates the hostname. It does not make the site trustworthy, scan the content for malware, or prove the business is legitimate. Phishing sites can have valid certificates.
Evaluate trust separately: who operates the site, what data it asks for, and whether the domain matches the organisation you expect.
Common causes of browser warnings
Expired certificate, hostname mismatch, incomplete chain, clock skew on the client, and corporate TLS inspection are the usual suspects. A warning on one network but not another often points to interception or a missing intermediate rather than a broken server.
Frequently asked questions
Does a certificate check tell me if my site is hacked?
Why does the certificate show a different expiry than my dashboard?
Put it into practice
SSL Certificate Checker
Check TLS issuer, expiry and covered domains.
HTTP Header Checker
Response headers plus a practical security-header audit.
DNS Lookup
Query DNS records over DoH with multiple record types.
Public IP Lookup
See your public IP, ISP, ASN and approximate location.