TLS & certificates · Quick reference

TLS certificate reference: trust, names, expiry and protocol checks

A TLS report is a set of measurements from one client at one time. CheckSSL’s basic connection score covers trust, hostname and validity. Additional checks retain their own results; a high score does not override a revoked certificate or guarantee compatibility with every client.

Connection verification

Diagnostic certificate details come from a handshake without verification. Treat them as evidence to investigate, not as a trusted connection.

Connection verification
Finding	Interpretation	Next check
Trust	Peer verification succeeded, failed or was not completed.	Investigate the error with certificate verification enabled.
Hostname	The certificate must cover the exact requested DNS name.	Compare SAN names and the requested host; *.example.com does not cover example.com.
Chain	The trust path depends on certificates and the client trust store.	Compare the served bundle with the CA instructions; the root may be omitted.
Unknown	The measurement did not establish an outcome.	Check the stop reason and verify independently before changing configuration.

Reference: RFC 9525: Service Identity in TLS

Certificate fields

Compare the served certificate with the one you deployed. A renewed file on disk may differ from the certificate at a CDN or load balancer.

openssl x509 -in certificate.pem -noout -dates -serial -fingerprint -sha256

Certificate fields
Field	What it tells you	Review point
Valid from / until	The certificate validity window in UTC.	Check the served dates and the renewal/deployment process.
SAN	Names included in the certificate.	Check apex and www individually.
Serial / SHA-256 fingerprint	Identifies the certificate for comparison.	Compare before and after certificate deployment.
Public key / signature	Key and signature metadata.	Review current client/provider requirements; this is separate from the basic score.
Received chain	Certificates sent by the endpoint.	Received order and a trusted path are distinct checks.

Reference: OpenSSL: x509

Protocol probe outcomes

Negotiating one TLS version does not enumerate every accepted version. Extended CheckSSL scans use separate bounded probes.

Protocol probe outcomes
Result	Meaning	Next check
Supported	This client negotiated that requested version.	Keep versions aligned with your compatibility requirements.
Not supported	The probe established rejection of the requested version.	Confirm the intended server protocol policy.
Unknown	The probe could not establish support or rejection.	Review local client support, connectivity and scan limits.
Legacy TLS	TLS 1.0 or 1.1 was accepted by a probe.	Review disabling these obsolete versions at the TLS termination point.

Reference: RFC 8996: Deprecating TLS 1.0 and TLS 1.1

Revocation, CAA and transparency

These findings answer different questions. An unavailable revocation measurement is not an assurance that a certificate is unrevoked.

Revocation, CAA and transparency
Check	Scope	Action
Revoked	A checked revocation source reports revocation.	Replace the certificate and investigate with your issuer.
Good / unknown	A source reported good, or a result could not be established.	Read the method and reason; good does not replace connection verification.
CAA	DNS records express certificate issuance policy.	Review records and aliases; issuer authorization and DNSSEC are not verified by this scan.
Certificate Transparency	The report may detect SCT-related certificate data.	Presence does not establish valid log inclusion or CT compliance.

Verify the public endpoint

Use a current trust store. This command requests the named endpoint, verifies the hostname and stops on verification errors. Review the verification outcome as well as the received certificate list.

openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com -verify_return_error -showcerts </dev/null

Connect to the same hostname shown in the report.
Resolve the specific deployment or trust-store problem identified by verification.
Rescan after deployment and compare the served certificate and trust result.

Reference: OpenSSL: s_client

From scan to solution

Get to the cause of a certificate warning

A certificate can be in date and still fail verification. CheckSSL examines the TLS connection on port 443, including trust, hostname and validity. These guides help you distinguish an approaching expiry from a name mismatch or a chain problem, so you can investigate the right part of your hosting setup.

Certificate renewal