Seen From Outside Free report

2 of 7 things we check

Certificates

Is the certificate behind the padlock valid, trusted and not about to run out?

Your website, drawn as a building. This page is about number 2, Certificate.

What we look at

  • In date. More than 30 days left is a pass. 30 days or fewer is a Medium problem, and a week or less, or expired, is a High one.
  • The right name. The certificate covers the address people actually visit.
  • Trusted. Browsers recognise who issued it. A home-made certificate is a High problem. One with a missing link in its chain is a Medium one, because some browsers and apps may refuse to connect.
  • Old versions turned off. Your site refuses TLS 1.0 and 1.1, the retired versions of the technology behind the padlock.
  • Current versions on. It accepts TLS 1.2 or 1.3.
  • The newest version. Whether TLS 1.3 is on. Never changes your score.

Why it matters

The certificate is what lets a browser show the padlock without a fuss. If it runs out, or doesn't match your address, visitors get a full-page warning instead of your site.

Certificates need renewing, often automatically. A look from outside is an easy way to know the renewal is still working.

In our sample report

Here's this part of our sample report for a demo website. example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.

Sample report · example.com · illustrative data

Certificates

100 out of 100. 6 of 6 checks completed

6 passed

  • Passed Certificate validity

    The certificate for example.com is valid for 196 more days

  • Passed Certificate name

    The certificate for example.com matches the name

  • Passed Certificate trust

    The certificate on example.com is trusted

  • Passed Outdated TLS versions

    example.com does not accept TLS 1.0 or 1.1

  • Passed Modern TLS versions

    example.com supports TLS 1.2 or 1.3

  • Passed TLS 1.3

    example.com offers TLS 1.3

Who fixes it

In your report, anything to fix in this area goes to:

  • Your web host or website developer.

What we can't see from outside

We read the certificate your site sends and see which versions it accepts. We can't see how the certificate's private key is kept. If your site answers only on plain http://, these checks can't run, and this part of your score is 0.