Understand SSL certificate checks and expiry thresholds

Interpret daily TLS validation, certificate details, and expiry severity.

Last checked 21 August 2026

The SSL Validation Checks card reads the TLS certificate served for the monitored hostname on port 443. The card says Checked daily from this computer and can show:

  • Browser Validation (Pass, Fail, or Pending)
  • Issuer
  • Organization Name
  • Certificate Type
  • Valid From
  • Expires On
  • Days Remaining

Browser Validation is a Pass or Fail badge after the lookup completes, or Pending while the check is still running. Pass means the desktop browser engine accepted the certificate for this hostname (or TechDash fell back to local trust-store validation when browser probing was unavailable). Fail means the browser rejected the certificate, hostname coverage failed, the certificate was not yet valid or had expired, or the connection could not be validated.

Certificate types are displayed as Domain Validated, Organization Validated, Extended Validation, or Unknown when TechDash cannot classify the subject. A validity period under 92 days is labelled Short Lived - Auto Renew. A longer period is labelled Long Life - Manual Renew. These labels describe the expected renewal pattern, not proof that automation or manual ownership is configured correctly.

Understand the daily schedule

SSL lookups become due 24 hours after their last attempt. The lookup scheduler reviews due websites once an hour while monitoring is active. It also queues lookups when a website is created or refreshed.

The actual start can be later if the app is closed, the computer is asleep or offline, the license is unavailable, monitoring is paused, or another SSL job is ahead. SSL jobs use their own SSL queue and wait one second between jobs.

Successful lookups replace the stored certificate details and checked time. Failed lookups retain the previous details, set the lookup state to failed, store the error, and update the checked time. The card then displays the failure message instead of the prior rows.

Read expiry severity

TechDash calculates whole calendar days remaining using UTC day boundaries. It colors Expires On and Days Remaining, and creates Certificate expiring soon when a threshold is crossed.

For certificates with a total validity of 92 days or more:

  • 30 days remaining is still normal.
  • 29 through 7 days remaining is Warning.
  • 6 days or fewer is Critical.

For certificates with a total validity under 92 days:

  • 7 days remaining is still normal.
  • 6 through 2 days remaining is Warning.
  • 1 day or fewer is Critical.

An expired certificate therefore remains Critical. Short-lived certificates use tighter thresholds because they normally renew frequently. An incident can notify when first observed at Warning and again if it escalates to Critical. An unchanged incident at the same severity does not repeatedly notify on every daily lookup.

Understand Certificate invalid

Certificate invalid is a Critical incident when TLS validation or the connection fails. TechDash distinguishes the underlying error in the incident evidence. Examples include:

  • The certificate chain is not trusted by the monitoring computer.
  • The certificate does not cover the exact monitored hostname.
  • The certificate is not valid yet or has expired.
  • Port 443 refuses the connection or another network error occurs.
  • The server returns no peer certificate.
  • The lookup reaches its fixed hard timeout.

TechDash opens the TLS socket with automatic rejection disabled so it can read the peer certificate and preserve the specific authorization error. It then validates the monitored hostname against certificate identities (including SAN and wildcard rules), checks the certificate's active dates, and probes browser-grade trust through an isolated verification session when available. A successful lookup therefore confirms hostname coverage and that browser or local trust-store validation accepted the chain for this computer at the time of the check.

The hard timeout destroys the socket and records a timeout error rather than allowing the lookup to remain open indefinitely. A timeout is evidence that validation could not complete, not proof that the certificate itself is malformed.

This is a strong current-host check, but it is still one connection from this computer. It does not test every CDN edge, client trust store, browser version, network route, or alternate hostname. For production troubleshooting, separately confirm that all relevant edges serve the intended chain and that every public hostname used by customers is covered.

Respond to expiry or lookup failure

For expiry:

  1. Confirm whether renewal is automatic or manual.
  2. Check the certificate authority, CDN, hosting platform, and DNS challenge state.
  3. Verify that the renewed certificate is deployed to the monitored hostname, not merely issued.
  4. Check all relevant edges if deployment is distributed.

For a failed lookup:

  1. Test port 443 from the same computer and network.
  2. Check DNS resolution, firewall policy, SNI configuration, VPN, proxy, and local security software.
  3. Compare the incident error with server and CDN logs.
  4. Fix the connectivity or certificate-serving problem before retrying.

Use Check & Verify from an SSL incident to run the SSL lookup immediately and refresh the incident. Check now in Site Resources does not run SSL, RDAP, or DNS lookups. Without a manual incident recheck, wait for the next daily SSL lookup and the hourly scheduler sweep.

Related articles