What to Check When Your HTTPS Certificate Goes Wrong

An HTTPS certificate that has expired, been misconfigured, or been revoked can stop visitors from reaching your site. Browsers show warnings that scare people away, and search engines may penalise the domain. The fix is rarely complicated, but knowing where to look first saves time. This article walks through the main points to check when your certificate is not working the way it should.

Is the Certificate Actually Expired?

The most common cause of an HTTPS warning is a certificate that has passed its validity date. Certificates are issued for a limited period - typically one year or two years, depending on the issuer. Once that date passes, the browser treats the connection as untrusted. A simple way to verify this is to use a certificate expiry checker, which will tell you the exact expiration date and whether the certificate is still valid. Many such tools also show the issuer, the subject alternative names (SANs), and the certificate serial number, giving you a full picture of its current state.

Does the Certificate Match Your Domain Name?

Even a validly issued certificate will cause errors if the domain name it covers does not match the address visitors type. A certificate issued for "www.example.com" will not work for "example.com" unless both names appear in the SAN list. The same applies to subdomains: a wildcard certificate covers "*.example.com" but not "example.com" itself. When you run a check with a tool like UtiBox - The Web Utility Box SSL checker, it will compare the requested hostname against the certificate's SANs and common name (CN). If there is a mismatch, the browser will refuse to connect securely.

Has the Certificate Been Revoked?

A certificate can be revoked before its expiration date if the private key is compromised, the certificate was issued incorrectly, or the domain ownership changed. Revocation status is checked via the Certificate Revocation List (CRL) or the Online Certificate Status Protocol (OCSP). Most SSL checkers will query the OCSP responder for the certificate and report whether it has been revoked. If the OCSP responder is unreachable, some browsers may still accept the certificate, but others will treat the connection as less secure. It is worth testing this specifically, because revocation can be silently missed in routine monitoring.

Is the Certificate Chain Complete?

A certificate is only as trustworthy as the chain that connects it to a trusted root CA. The server must send the intermediate certificates along with its own leaf certificate. If the server omits an intermediate, the browser may fail to build a complete chain and show an error. This is a common misconfiguration after renewing a certificate manually: the new certificate is installed, but the intermediates are not updated. An SSL checker will display the entire chain sent by the server, so you can verify that every link is present and valid. If a link is missing, you need to download the correct intermediate certificate from your CA and install it on the server.

Is Your Server Serving the Correct Certificate?

When a server hosts multiple websites (virtual hosting), it is possible for the wrong certificate to be served for a given domain. This can happen if the server's SNI (Server Name Indication) configuration is incorrect, or if the default virtual host does not have the right certificate bound. Testing this is straightforward: run an SSL check from the outside, using the exact domain name a visitor would type. The tool will show which certificate the server presents. If it shows a different domain's certificate, you need to reconfigure the web server to match the correct certificate to the correct hostname.

Does the Certificate Use a Strong Cipher and Protocol?

Even if the certificate itself is valid, the server must support encryption protocols and ciphers that modern browsers consider secure. TLS 1.0 and TLS 1.1 are deprecated; the minimum acceptable version is TLS 1.2, with TLS 1.3 being the current standard. Cipher suites that use weak algorithms like RC4, 3DES, or export-grade ciphers will cause warnings or outright connection failures. An SSL checker will report the protocols and ciphers your server supports. If you see outdated entries, update your web server configuration to disable them. This step is often overlooked after a certificate renewal, but it directly affects whether visitors can connect.

Is Your Private Key Protected and Correct?

The private key must remain secret and must match the public key in the certificate. If you accidentally use the wrong private key file, or if the key is stored in a location the web server cannot read, the TLS handshake will fail. Some SSL checkers verify that the private key matches the certificate by attempting to decrypt a test message. If the key is missing or mismatched, the server will not be able to negotiate a secure connection. Check that the private key file is in the correct format (PEM, typically) and that its permissions allow the web server process to read it. A common mistake is to set permissions too restrictively, so the server process cannot access the key at all.

Is There a Redirect Loop or Mixed Content?

After fixing the certificate itself, the next issue is often the site's internal links. If the site loads over HTTPS but references images, scripts, or stylesheets over HTTP, browsers will flag the page as having mixed content. This does not break the connection, but it can cause the padlock icon to disappear or show a warning. Similarly, a misconfigured redirect from HTTP to HTTPS can create a loop if the server redirects the same request repeatedly. Check each page's source code for hardcoded HTTP URLs. Use a tool that crawls the site and reports any insecure resources. Fixing mixed content usually involves updating the URLs to use HTTPS or relative paths.

How to Keep Track of Certificate Health

Regular monitoring is the only way to avoid surprises. You can set up automated checks that run daily or weekly, using a certificate expiry checker that sends an alert when the expiration date approaches. Many such tools are free and require no installation. For example, UtiBox - The Web Utility Box SSL checker offers a straightforward interface where you can enter a domain and instantly see the certificate's validity period, issuer, chain, and any warnings. Running this check periodically, especially after any server configuration change, helps catch problems before they affect visitors. It is a small habit that prevents large headaches.

A final tip: do not rely solely on the browser. Browsers sometimes cache certificate information or fail to show the full details of a chain error. Using a dedicated SSL checker gives you a complete, technical view of the certificate state. Combine it with server logs to see if any clients are reporting handshake failures. With these checks in place, you can be confident that your HTTPS setup is working correctly and that visitors will see a secure, trusted connection every time they arrive.

UtiBox - The Web Utility Box on social media YouTube