TLS certificate checks
Five checks, and only one of them is the expiry date. Automated renewal made expiry rarer without making it rare - renewal jobs fail quietly on a schedule nobody reads - so days remaining is watched against a threshold rather than compared to yesterday. The other four catch the failures that have no deadline: an incomplete chain, a certificate that no longer covers the hostname, an unexpected issuer, and a change in which TLS versions the server will accept.
The incomplete chain is the one that fools everybody
A server that sends its leaf certificate but omits an intermediate produces a site that works perfectly in Chrome and fails in curl, on older Android, in some corporate proxies, and for crawlers. Chrome repairs the gap from intermediates it has cached; nothing else is obliged to.
This means the standard verification - open it in a browser - passes on exactly the sites that have the problem. It is checked here because it cannot be checked the way people check it.
An issuer change is either routine or serious
Certificates are reissued constantly and the authority changing is often a planned infrastructure move. It is also what a misissued certificate looks like. The check does not attempt to tell you which - it tells you it happened, and somebody who knows whether it was planned can spend ten seconds confirming it was.
The CAA record check in the domain group is the other half of this: CAA controls which authorities may issue for the domain at all, so a change there usually precedes a change here.
All 5 checks in this group
Certificate expiry
on by default · per domain · confirmed over 2 runs
The TLS certificate is approaching expiry.
Days remaining against a threshold. Certificates renew automatically now, so the failure mode is a renewal job failing quietly rather than anyone forgetting.
Certificate issuer
on by default · per domain · confirmed over 3 runs
The certificate was issued by a different authority.
Issued by a different authority than last time. A planned infrastructure change, or the first visible sign of one nobody planned.
Certificate chain complete
on by default · per domain · confirmed over 3 runs
The certificate chain is incomplete - works in Chrome, fails elsewhere.
The case that works in Chrome and fails everywhere else. Chrome repairs a missing intermediate from cache; curl, older Android and most crawlers do not.
Certificate covers this host
on by default · per domain · confirmed over 3 runs
The certificate no longer covers this hostname.
The SAN list no longer includes the hostname. A valid certificate for the wrong name is still a full-page browser warning.
Accepted TLS versions
off by default · per domain · confirmed over 4 runs
The set of accepted TLS versions changed.
Off by default. The set of versions the server accepts changed - either a hardening step, or a downgrade nobody intended.
Every check on this page is available on every plan, including the free one - limits are on sites and URLs, never on checks. CrawlWarden pricing, per site rather than per URL.