What this checks
We connect to the site on port 443 like a browser would, read its certificate and chain, verify it against trusted authorities, and check the TLS version, the HTTP-to-HTTPS redirect and the HSTS header.
Common problems
Expired certificates (usually a broken auto-renewal), a missing intermediate certificate, a certificate issued for the wrong name (www vs. non-www), and sites that still load over plain HTTP.
Frequently asked questions
Usually mixed content (images or scripts loaded over http://), a certificate for the wrong name, or a missing intermediate certificate.
Let’s Encrypt certificates last 90 days and should renew automatically about 30 days before expiry. If you see fewer than 14 days left, renewal is probably broken.
Yes. The encryption is the same; paid certificates add organisation validation, longer validity or a warranty.