How to Check SSL Certificate Errors and Expiry: Plus TLS Versions and CAA
By the IDEAVALU team · Updated
With an invalid certificate, visitors hit a browser warning page and most leave on the spot. Expiry often strikes without warning when automatic renewal fails.
Check it yourself
openssl shows the certificate dates and issuer, and which TLS version the connection used.
Certificate dates and issuer
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject
Make sure TLS 1.1 is refused (an error is the good result)
openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/null
Why automatic renewal stops
Vercel, Netlify and Cloudflare issue and renew certificates automatically, but renewal fails if you point DNS at another service. If you run certbot on your own server, check that its timer (cron or systemd) is running and that port 80 is not closed.
Limit issuers with a CAA record
A CAA record declares in DNS which certificate authorities may issue certificates for your domain, which lowers the risk of a certificate being issued elsewhere without your knowledge. Forgetting your host's authority makes renewal fail, so double-check it.
How to fix
HTTPS availability
Make the site load over HTTPS. Vercel, Netlify, Cloudflare Pages and similar hosts issue a certificate automatically when you add a custom domain.
Add the domain in your hosting dashboard and create the DNS records (A / CNAME) it shows you.
On your own server, get a certificate from Let's Encrypt (for example with certbot) and listen on port 443.
Valid SSL certificate
Replace it with a certificate from a trusted authority. The usual causes are expiry, a domain name mismatch or a self-signed certificate.
Check that the certificate covers both the www and non-www names.
Reissue the certificate in your hosting dashboard, or get a new one from Let's Encrypt. Install the intermediate certificate too.
Certificate expiry
Renew before it expires, and check that automatic renewal has not stopped.
certbot
sudo certbot renew --dry-run
If your host issues certificates for you, check that DNS still points to that host. Renewal fails when it points elsewhere.
TLS version
Disable TLS 1.0 and 1.1 and accept only TLS 1.2 and later.
nginx
ssl_protocols TLSv1.2 TLSv1.3;
CAA (allowed certificate issuers)
Add a CAA record to DNS to limit which certificate authorities may issue certificates.
Using Let's Encrypt (Vercel and Netlify use it too)
CAA @ 0 issue "letsencrypt.org"
With Cloudflare certificates, also add the authorities Cloudflare lists (such as Google Trust Services). Missing one makes renewal fail.
FAQ
- I get a certificate name mismatch error
- The name in the certificate does not match the domain you opened. Include both the www and non-www names in the certificate, or redirect one to the other.