SSL Certificate Checker

How the SSL check works

We connect to port 443 on the host, complete the TLS handshake and read the certificate it presents, just as a visitor's browser would. Because the check does not test the certificate against a local trust store, it also works on self-signed certificates, which is handy when you are debugging a staging server.

What to look for

• The expiry date. Certificates today last anywhere from 90 days (Let's Encrypt) to a year. Once one lapses, browsers show a full-page warning that wrecks sales and sign-ups.
• Names covered. Every host name you use, such as example.co.ke, www.example.co.ke and mail.example.co.ke, has to appear in the certificate's Subject Alternative Names.
• The signature algorithm. Current certificates are signed with sha256WithRSAEncryption or ECDSA, and today's browsers refuse older algorithms.
• Who issued it. The certificate should come from a recognised CA such as Let's Encrypt, DigiCert, Sectigo or Google Trust Services. An unknown issuer brings up security warnings.

Looking for a free SSL certificate?

Free Let's Encrypt SSL that renews itself is part of every SiteBoma hosting plan. Our free SSL guide explains the details.