CERT
WAITINGHTTPS certificate
Enter a domain above to run this check.
HTTPS CERTIFICATE
CHECK.
See in the Certificate Transparency logs the newest valid certificate of the domain: issuer, expiry and the names it covers (SAN).
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
What the check verifies
Searches the public Certificate Transparency logs for the newest valid certificate of the domain: issuer, validity and names covered.
Why it matters
An expired certificate takes the site down with a security warning. The Cloudflare Worker cannot read the certificate of the connection, so the data comes from the public logs.
What each result means
- OK
- There is a valid certificate for the name, expiring in more than 14 days.
- WARNING
- The newest certificate expires in 14 days or less, or no valid certificate for the name shows in the logs.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
Check the automatic renewal (certbot, acme.sh or the CDN panel). The certificate actually served may not be the last one issued; to see it:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -issuer -dates -ext subjectAltNameWould rather have someone else do it? Bit Happens can fix this →
More checks in Certificates
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →