Common problems this finds
- Expired or soon-to-expire certificates (automatic renewal failed).
- A missing intermediate certificate: works in some browsers, fails in apps and older devices.
- The hostname is not in the certificate (often www versus the bare domain).
- Old TLS versions, SHA-1 signatures or short RSA keys.
- No HSTS header.
How the check runs
Our server resolves the name, refuses private and reserved addresses, connects to port 443 with SNI, records the handshake and certificate chain, then makes one HEAD request for the HSTS and Alt-Svc headers. Trust is judged against the Mozilla root store used by Node.js.
Questions
- How long do certificates last now?
- At most 398 days today, with the CA/Browser Forum reducing the maximum in steps to 47 days by 2029. Automatic renewal is the only practical way to keep up.