Question 1

How many days before expiry should I renew?

Accepted Answer

Renew at least 14–30 days before expiry. Most cert authorities offer 60–90 day windows for renewal anyway, and automated systems (Let's Encrypt, ACME) renew at 30 days remaining. The tool flags certs with under 30 days as a warning, under 14 as urgent.

Question 2

What does 'SAN' mean and why does it matter?

Accepted Answer

Subject Alternative Name — the list of hostnames the certificate is valid for. A cert for example.com that doesn't include www.example.com in its SAN will fail when users visit the www version. Multi-hostname certs put every covered name in the SAN list.

Question 3

Why is the issuer 'Let's Encrypt' but my cert was bought from another vendor?

Accepted Answer

Many shared hosting providers (Cloudflare, Vercel, Netlify) automatically issue Let's Encrypt certs by default — even if you have a paid cert sitting in your dashboard, the edge may be using its own free one. Check your CDN's TLS settings if this surprises you.

Question 4

Does this support TLS 1.3?

Accepted Answer

Yes — the tool reports whichever TLS version negotiated, including 1.3. Servers that still allow TLS 1.0 / 1.1 are flagged as outdated; modern security baselines require TLS 1.2+.

SSL Certificate Checker

More Website Tools

Page Speed Audit

Email Header Analyzer

HTTP Headers Inspector

The all-in-one work dashboard for small teams