A site's HTTPS validity, issuer and expiry date.
When you run the check, NetCheck opens an encrypted connection to the site, just as a browser would, and retrieves the certificate the server presents. No intermediate database: it is the certificate actually being served at that moment.
| Field | What it means |
|---|---|
| Issued by | The certificate authority that signed it: Let's Encrypt, Sectigo, DigiCert, Google Trust Services… |
| Valid from / to | The period during which browsers accept the certificate. Outside it, they show a blocking warning. |
| Days left | The time before expiry. This is the number to watch. |
| Also covers | The other names listed in the certificate (the SAN field). A certificate is only valid for the names it lists. |
The rules of the CA/Browser Forum, which brings together certificate authorities and browser makers, are shortening this in stages. Since March 2026, a public certificate cannot be valid for more than 200 days. The cap drops to 100 days in March 2027, then to 47 days in March 2029. Let's Encrypt certificates already last 90 days.
In practice, renewing by hand is becoming untenable. If your host or server does not renew automatically (through the ACME protocol, for example with Certbot), now is the time to automate it. Aim to renew two to three weeks before expiry, so you have time to react if automation fails.
example.com but not www.example.com, or the other way round. Look at the “Also covers” line: both forms must be listed.http://. The browser then shows a broken padlock. This is not a certificate problem: fix the addresses in the page.A domain-validated (DV) certificate only proves that the requester controls the domain. It is what Let's Encrypt issues, free of charge, with exactly the same encryption as paid certificates. OV and EV certificates add a check of the company's identity, but browsers stopped showing that difference in the address bar years ago. For the vast majority of sites, a free, properly renewed DV certificate is enough.
A *.example.com certificate covers every subdomain one level down, such as blog.example.com or shop.example.com, but neither example.com itself nor a.b.example.com. It simplifies management when there are many subdomains, at the cost of greater risk if its private key leaks.
To read the certificate, NetCheck negotiates the connection in TLS 1.2, the version in which the certificate travels unencrypted during the initial handshake. Almost every server still accepts it. A server configured for TLS 1.3 only will return an explicit message: the site works, but the tool cannot read its certificate.
For an HTTPS check, NetCheck connects to the site on port 443, sends the domain name the way a browser does (SNI) and reads the certificate the server is serving right now. That gives you this result:
| What you see | What to check |
|---|---|
| Green, with a number of days | Valid. With automatic renewal, the number should go back up after each renewal. |
| Orange | Fewer than 15 days before expiry: check the renewal now. |
| Red, "Certificate EXPIRED" | Browsers block the site until a new certificate is installed. |
| Valid from / Valid until | If "Valid from" is in the future, the certificate is not active yet. |
| Issued by | The certificate authority. An unexpected issuer can point to a proxy or to an old certificate left in place. |
| Also covers | The names in the certificate. The address you checked must appear here, directly or through a wildcard such as *.example.com. |
Whether the name matches is up to you: the tool lists the covered names but does not compare them for you. The certificate chain is not checked either, because NetCheck reads only the site's own certificate, not the intermediate ones. If a browser reports a chain error while everything here is green, inspect the chain from the command line:
openssl s_client -connect example.com:443 -servername example.com -showcerts
The output should list at least two certificates: the site's and the certificate authority's intermediate. If there is only one, the server is missing its "fullchain" file.
After a renewal, also test www and the bare domain separately: the two addresses can point to different servers or CDN settings.
Most often: a name that isn't covered (with or without www), an incomplete chain, or mixed content loaded over http. Also check the device clock: a clock several days off makes the browser think a valid certificate has expired, or is not yet active.
With automatic renewal, nothing to do: just check that the date moves forward regularly. Without automation, renew two to three weeks ahead. Under a week, treat it as an emergency.
No. The encryption is identical. What a paid certificate adds is identity verification, support and sometimes a financial warranty, not connection security.
No. It only means the connection is encrypted and the certificate matches the domain. A phishing site can perfectly well have a valid certificate. Look at the domain name, not the padlock.
The certificate is still valid but expires in fewer than 15 days. Check that automatic renewal is set up and working, or renew the certificate by hand now.
No. NetCheck reads the site's certificate with its issuer, validity period and covered names. Check the intermediate certificates with openssl s_client -showcerts or from the browser's error message.
Yes. Type the full name, for example shop.example.com. NetCheck connects with exactly that name and shows the certificate the server serves for that subdomain.
A URL's server, redirects, caching and security headers.
OpenYour public IP, your provider, your approximate location.
OpenA domain's A, AAAA, MX, TXT, NS and CNAME records.
OpenCheck whether your DNS is up to date around the world.
OpenA domain's owner, creation date and expiry date.
Open