Skip to main content
SlapMyWeb
Slap a site
Security

SSL Certificate

The credential enabling HTTPS. Expires on a schedule; a broken renewal takes the whole site down.

An SSL certificate (properly a TLS certificate) is the credential proving a site's identity and enabling the encrypted HTTPS connection. Browsers refuse to load pages whose certificate is expired, mismatched or untrusted. Certificates are free through Let's Encrypt, and expiry is the most common way a site goes down.

Definition

An SSL certificate — strictly a TLS certificate — is the credential that lets a site serve HTTPS. It binds a domain name to a public key and is signed by a certificate authority the browser already trusts, which is what allows a browser to encrypt traffic and be confident about who it is talking to.

Certificates expire, typically after 90 days for automatically issued ones. Renewal is normally automated, which is exactly why a broken renewal goes unnoticed until the certificate lapses and every visitor gets an interstitial warning.

A wildcard certificate covering *.example.com can only be validated over DNS, not HTTP — a detail that quietly breaks renewals configured the other way.

Why It Matters

HTTPS is a confirmed ranking signal and a hard requirement for a long list of browser features. But the ranking effect is the small part: an expired certificate makes every browser block the site behind a full-page warning, so the practical impact is a total outage.

Certificate failures are also uniquely silent from the server’s point of view — the application is healthy, the process is running, and no error appears in the application log.

Example

Check the expiry directly rather than trusting the renewal timer: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates. Worth monitoring as a scheduled check — the failure mode is a cliff, not a slope.

Expiry is the failure mode, not misconfiguration

Certificates are free and issuance is automated, so the interesting risk is not getting one — it is renewal quietly breaking and nobody noticing until the browser warning appears.

The pattern is consistent: automated renewal is configured, something changes underneath it — a plugin, an authenticator, a DNS provider — and the renewal fails silently every night for weeks. The site keeps working, because the existing certificate is still valid, right up until the day it is not.

Two defences. Monitor days-to-expiry as a metric rather than waiting for the failure, and periodically run the renewal in dry-run mode, which catches a broken configuration while there is still time to fix it. A wildcard certificate needs particular care: it can only be issued through a DNS challenge, so a renewal configured for an HTTP challenge will fail every time while appearing to be set up correctly.

How SlapMyWeb checks this

The audit validates the certificate chain, checks the expiry date, and confirms the hostname matches — then reports days remaining, because expiry is the most common way a working site goes down. It also checks that HTTP redirects to HTTPS and that no resource on the page loads over plain HTTP. The matching fix guide is how to fix a missing SSL certificate.

Related Terms

HTTPSHSTSSecurity HeadersMobile Redirect

Related Tools

SSL Certificate CheckerHTTP Header Checker

Know the term.
Check your own site.

A free audit tells you whether this is currently costing you score points — and exactly what to change.

Run a free audit
Free foreverNo signupResults in 30s