certificate chain and expiry
What it can report
- ✗ critical the leaf's notAfter has passed. How to fix it
- ✗ critical notBefore is in the future. How to fix it
- ✗ critical when fewer than 14 days (PLAN) and under a third of the lifetime remain; medium when fewer than 30 days and under a quarter of the lifetime remain. The lifetime fractions follow ACME renewal: certbot renews a 90-day certificate at 30 days left, so 29 days left is normal but 22 means renewal has failed for a week; a 6-day short-lived certificate is not "expiring" the day it is issued. Medium rather than high below 30 days: weeks of runway are a reminder, not an outage. How to fix it
- ✗ critical the leaf does not cover the host (including certificates that name it only in the subject CN). How to fix it
- ✗ critical (critical) How to fix it
- ✗ critical browsers show an interstitial. How to fix it
- ✗ high the server omits an intermediate. Browsers that fetch it through the AIA URL or preload intermediates cope, many other clients (curl, mobile apps, API clients) fail. The check fetches the AIA "CA Issuers" URL through Input.HTTP (a request browsers make) to confirm the completed chain is trusted. How to fix it
- ✗ high an intermediate the server sends has expired. How to fix it
- ✗ high RSA under 2048 bits, ECDSA under 256 bits, or DSA. How to fix it
- ✗ high SHA-1 or MD5 signature on the leaf or an intermediate (browsers refuse them). How to fix it
- ✗ critical netx.VerifyChain refuses the chain for a reason none of the above names. How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 5 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.