SSL certificates

Every https site gets an SSL check when you add it. The check opens a secure connection to your site, reads the certificate and closes the connection. It doesn’t load any page.

Each check records the certificate’s issuer, the names it covers and its expiry date, so you can tell whether automatic renewal is still working.

How often

Every day on every plan. An expiry date is known well ahead, so that’s enough to warn you in time.

Expiry warnings

SEOComet counts the whole days left until the certificate expires.

• Fewer than 21 days left: a warning.
• Fewer than 7 days left: critical.

You can change both on the check’s Settings tab, under Warn when fewer days are left than and Critical when fewer days are left than. The critical number can’t be higher than the warning number.

As the days run down, the warning incident becomes critical and sends a Got worse alert. When the certificate is renewed, the next check resolves it.

Always critical

Some problems are critical straight away, whatever your thresholds:

• Expired: the certificate’s end date has passed.
• Name mismatch: the certificate doesn’t cover the site’s host name. A wildcard like *.example.com covers one level, such as www.example.com, but not example.com itself.
• Not trusted: browsers can’t trace the certificate back to an authority they trust, often because the server doesn’t send its intermediate certificates.

Browsers show a security warning for each of these, and most visitors leave.

If SEOComet can’t open a secure connection to the site at all, that’s a warning.

The www address too

The www and non-www versions of a site often have separate certificates, and one can expire while the other renews. So on the site’s own host, SEOComet also reads the certificate of the other version, with www added or taken away.

If both have a problem, the check reports the worse one and lists both. If the other version can’t be reached, for example because it has no DNS record, it’s skipped.

What it can find