What the results mean
"Matches domain" means the certificate covers the exact name you entered. Days left are flagged at 30 or fewer. "Trusted" means the chain verifies against a standard set of trusted root CAs; "Not trusted" usually means a missing intermediate certificate, an expired certificate or a name mismatch. "Certificates served" counts your certificate plus the intermediates the server sends.
How the check works
Our server connects to one public address of the domain on port 443 and reads the certificate it presents. Domains that resolve to private or reserved addresses are refused. We don't save your results.
Common questions
Why does it say "Not trusted" when my browser shows a padlock?
Desktop browsers can sometimes fetch a missing intermediate certificate themselves; many phones and apps can't. Install the fullchain file from your download kit.
Why is a new certificate valid for only 200 days?
That is the industry maximum under CA/Browser Forum ballot SC-081: up to 200 days now; up to 100 days from 15 Mar 2027; up to 47 days from 15 Mar 2029. Plans of a year or more include free reactivation.
Does it check every server behind my domain?
No. It checks one public address on port 443. If you use a CDN or several servers, check the certificate on each one where you installed it.