SSL Certificate Checker

The checker warns below 30 days and shows an error below 7. Automated renewal via ACME normally triggers at 30 days, so a certificate inside that window without having renewed usually means the automation has broken.

Browsers match the hostname against the Subject Alternative Name list, not the Common Name, which has been ignored for years. A wildcard such as *.example.com covers one label only: it matches api.example.com but not a.b.example.com, and not the bare example.com unless that is listed separately.

It reports the chain the server presents and flags a missing intermediate, which is the most common misconfiguration. It does not perform full path validation against a trust store or check revocation.