SSL certificate validity
A certificate that's expired, expiring soon, or doesn't match the hostname breaks the site outright. What browsers do, and how to renew it.
What it is
This checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.
A certificate that fails any of those checks doesn't just look bad — browsers interrupt navigation with a full-page warning rather than rendering anything, for anyone using a default configuration.
Why it matters
Chrome, Safari and Firefox all treat an invalid certificate as a hard stop, not a subtler degradation: a visitor sees an interstitial telling them the connection isn't private, with an extra click required to proceed even for people who understand what they're seeing.
Because this fails a whole visit rather than one page, it's one of two checks — the other is the site not using HTTPS at all — that cap this scanner's overall score at 49 regardless of everything else the site does well.
How to fix it
with a reference doccertbot renew --cert-name example.com --force-renewalcertbot renew --cert-name example.comRelated checks
3This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.