What is an SSL certificate?

An SSL certificate (strictly a TLS certificate) is your site’s ID card. When someone opens your site over HTTPS, the server presents it and the browser checks three things: it was issued by an authority the browser trusts, the site’s name is in the certificate’s list of names, and it has not expired.

Why it matters

If any of those checks fails, the browser shows a full-page warning instead of your site, and most visitors turn back there. Apps and services that connect to your site or API usually refuse the connection outright.

Four common problems

• Expired: the renewal did not happen. Get a new certificate and make renewal automatic (steps below).
• Wrong name: the site’s name is not among the certificate’s names; for example the certificate is for example.com but the site opens as www.example.com. Get a certificate that covers every name.
• Self-signed or untrusted: it was not issued by an authority browsers trust. Replace it with one from a public CA such as Let’s Encrypt.
• Incomplete chain: the server sends only the site’s certificate and not the intermediate one. Some browsers make up for it, but many apps fail. Configure the server with the full chain file (certbot calls it fullchain.pem).

Make renewal automatic

Certificates are short-lived and getting shorter: Let’s Encrypt certificates last 90 days, and under the CA/Browser Forum’s rules the maximum for all public certificates is 200 days from March 2026, dropping to 47 days by 2029. Renewing by hand is no longer practical.

1. Find out who gets the certificate. If your site is behind a CDN or on a host that manages HTTPS for you, renewal is usually automatic; just keep it switched on in their panel.
2. If you run the server yourself, install an ACME client; the most common is certbot, which gets free Let’s Encrypt certificates and can configure your web server too.
3. Request the certificate for every name; see the example command below.
4. Make sure automatic renewal is scheduled, and do a test run once.
5. Check the site on CheckNet’s SSL page and look at the expiry date and the names.

sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

If you have a CAA record, the CA you get certificates from must be named in it, or renewals fail.

Check it with CheckNet

On CheckNet’s SSL page the answer “Valid” comes with the days left; under 14 days it reads “Expires soon”. “Not valid” means browsers do not trust the certificate, and “Could not get the certificate” means the connection to the server failed. Below the answer you see the issuer, the expiry date and the certificate’s names. If you have the certificate’s text, paste it under “Have a certificate (PEM)?” on the same page to read what is inside.