SSL Checker

An SSL certificate proves a host’s name to the browser and has an expiry date. Days until expiry is the gap between today and that date. A real reading comes from the handshake. This screen shows the fields without that handshake.

About nine runs in ten are marked valid and about one in ten invalid. A second click can change the label without the server’s certificate changing. That alone is enough to keep the panel out of an audit.

Validity is one of the values SSL Checker puts on screen. A certificate is either accepted for the hostname or it is not. The sample marks valid on about 90 percent of runs and invalid on the rest. Clicking again can flip the label. The server did not reissue anything.

Read Issuer on its own before you mix it with the other rows. The issuer is the certificate authority that signed the certificate. A valid draw says Let’s Encrypt Authority X3. An invalid draw says Unknown Issuer. X3 is an old Let’s Encrypt name used here as a prop. It is not proof of the site’s CA.

Dates answers a narrower question than the headline number. Not before and not after bound the certificate’s lifetime. Valid-from is about one month before today and valid-to is about two months after today. The dates move when the calendar moves. They are not the certificate’s real notAfter.

Treat Days until expiry as a label with a specific job. A countdown from today to the not-after date. A valid draw shows 60 days. An invalid draw shows 0. Sixty is a constant in the sample, not a calculation from a real notAfter.

The Protocol and key line is worth a full stop. The handshake negotiates a protocol and a public key. The card prints TLS 1.3, RSA 2048-bit, and SHA256withRSA. A host that actually offers TLS 1.2 or an ECDSA key still gets these three strings.

The hostname is parsed from the URL so the card can print a name. Parsing a URL is not a TLS handshake. Protocol, key, and signature stay TLS 1.3, RSA 2048-bit, and SHA256withRSA whenever the sample is marked valid or invalid.

If you remember one sequence from SSL Checker, remember the fields in the order they change a decision. Validity matters because A certificate is either accepted for the hostname or it is not. In practice, The sample marks valid on about 90 percent of runs and invalid on the rest. The mistake to avoid is this: Clicking again can flip the label. The server did not reissue anything. Issuer matters because The issuer is the certificate authority that signed the certificate. In practice, A valid draw says Let’s Encrypt Authority X3. An invalid draw says Unknown Issuer. The mistake to avoid is this: X3 is an old Let’s Encrypt name used here as a prop. It is not proof of the site’s CA. Dates matters because Not before and not after bound the certificate’s lifetime. In practice, Valid-from is about one month before today and valid-to is about two months after today. The mistake to avoid is this: The dates move when the calendar moves. They are not the certificate’s real notAfter. Days until expiry matters because A countdown from today to the not-after date. In practice, A valid draw shows 60 days. An invalid draw shows 0. The mistake to avoid is this: Sixty is a constant in the sample, not a calculation from a real notAfter. Protocol and key matters because The handshake negotiates a protocol and a public key. In practice, The card prints TLS 1.3, RSA 2048-bit, and SHA256withRSA. The mistake to avoid is this: A host that actually offers TLS 1.2 or an ECDSA key still gets these three strings. After that, the checks are simple. You ran it twice and saw that the label can flip. You did not schedule a renewal from the 60-day figure. You did not name Let’s Encrypt as the CA from this card alone. You treated TLS 1.3 and RSA 2048-bit as sample labels. A browser certificate view is the source for any real date.

Keep SSL Checker as this step only. When the job moves on, the Header Checker is the next page: Header Checker asks for a URL and lists response headers, including a few security header names. The SEO Audit Tool covers a different piece of the same work: SEO Audit Tool sends the URL you enter to the iSkills server, which fetches that page and returns on-page checks plus a PageSpeed request.