Valid and secure SSL certificateWhat it checks and how to fix it

What it checks

Opens a TLS connection to the site and reads the certificate. A handshake error, an expired certificate or one not yet valid fails. A certificate expiring in fewer than 30 days gets a warning; otherwise it passes. Sites not on HTTPS are skipped.

Why it matters

An expired or invalid certificate puts a full-page security warning in front of every visitor, and most never click through. API clients, webhooks and payment integrations stop working entirely. Expiry is the most common cause, and it is entirely preventable with automatic renewal.

How to fix it

Renew the certificate and make renewal automatic, then confirm the server sends the full chain.

Let's Encrypt / certbot (nginx or Apache)

certbot renew --dry-run          # check renewal works
systemctl list-timers | grep certbot   # make sure the timer is active

nginx: point at the full chain, not the leaf alone.

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Apache

SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

Cloudflare: edge certificates renew automatically. Check SSL/TLS → Edge Certificates, and if the origin certificate is the problem, install a Cloudflare Origin CA certificate (valid up to 15 years) with SSL mode Full (strict).

Check the result:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates