SSL Certificate Check

A site's TLS certificate proves its identity and encrypts traffic between the browser and server. An expired, self-signed or mismatched certificate breaks trust and triggers browser warnings that drive visitors away. IPeek connects directly to the host, reads the live certificate, and reports its issuer, validity window, days remaining, the names it covers and any problems it finds.

During the TLS handshake the server presents a certificate signed by a trusted Certificate Authority. The browser checks that the certificate's name matches the hostname, that the signing chain leads to a root it trusts, and that the current date falls inside the validity window. If all three pass, the connection is encrypted and the padlock appears. "SSL" is the common name people still use, but the actual protocol has been TLS for years. IPeek performs this same handshake, then reports what the server returned instead of just rendering a padlock.

Start with days remaining: anything under 30 means renew soon, and a negative value means the certificate is already expired and visitors see warnings now. Check the issuer to confirm it is a real CA, not a self-signed placeholder. The Subject Alternative Name (SAN) list shows every hostname the certificate covers, so a certificate for example.com that omits www.example.com will fail on that variant. Finally, confirm the chain is complete; a missing intermediate certificate validates in some clients but breaks in others.

The most frequent failure is simple expiry, fixed by renewing and reloading the web server. A name mismatch means the hostname is not in the SAN list, so reissue with the correct names or add a wildcard. "Self-signed" or "untrusted issuer" errors mean the certificate chain does not reach a trusted root, usually because the intermediate certificate was not installed alongside the leaf. After any fix, recheck with IPeek to confirm the live certificate served on the wire matches what you intended, since stale certificates often linger in load balancers and CDNs.

Run a check before launch and whenever you migrate hosting, change CDNs, or rotate certificates, since these are the moments mismatches and missing chains appear. Set a reminder ahead of the expiry date, especially for certificates not on automated renewal. It is also the fastest way to diagnose a visitor reporting a browser security warning: the check tells you immediately whether the problem is expiry, a name mismatch, or a broken chain, so you can act instead of guessing.