SSL certificates

Catch certificate problems before your visitors see a browser warning.

What SSL checks cover

SSL checks track the validity, expiry date, and trust chain of the digital certificate that encrypts traffic between your site and its visitors. Your SSL certificate is the padlock in your browser's address bar. If it expires or breaks, browsers show a full-page warning before visitors reach your site. DomainDash checks your certificate on a schedule and starts warning you 30 days before it expires.

On the site page, the Security card opens the Security page, where you'll find the SSL details.

What we check

Every SSL check looks at six things:

• Is a certificate present? We make sure your site has a certificate installed.
• Has it expired? Certificates have a fixed lifespan. We track when yours expires and warn you in advance.
• Does it cover the right domain? A certificate issued for example.com won't work for shop.example.com. We check that your certificate matches the domain we're checking.
• Is the chain trusted? Your certificate is part of a chain that leads back to a trusted authority. If any link in that chain is broken, browsers won't trust it.
• Is it self-signed? Browsers don't trust self-signed certificates. We flag these so you know to switch to a proper certificate.
• Is the connection secure? We verify that the TLS (Transport Layer Security) connection, the encryption technology behind HTTPS, is working correctly.

Each check gets a pass or fail.

Modern certificates have short lifespans on purpose. Let's Encrypt issues 90-day certificates, and the wider industry is moving toward shorter renewal cycles. A missed renewal can take your site offline within weeks.

Expiry warnings

The warnings are the same on every plan:

Time remaining	What happens
30 days or fewer	The site's dashboard card shows Renews · N days, and the site page header shows Security expiring when uptime is healthy. No incident opens yet.
7 days or fewer	DomainDash opens an incident at Worth knowing, and the site's dashboard card reads Alert in place of Renews · N days.
1 day or less	The incident rises to Needs a look.
Expired	A separate expired incident opens at Needs fixing and the site shows a Security expired badge.

Both 30-day labels give way to anything more serious. The header shows Security expiring only while uptime is healthy and nothing more serious applies, and Renews · N days is outranked by Down, Security problem, Alert and Needs attention.

These incidents aren't Urgent, so they don't send an immediate alert. They appear in the app and in the daily digest, which goes out by email and, on Starter and above, Slack. A certificate expiring within 30 days also counts towards the Needs attention filter on your dashboard.

An invalid certificate (wrong hostname, self-signed, untrusted, a failed TLS handshake and so on) shows a Security problem badge on the site. The Security card and the Security page give the reason in plain English. A certificate problem doesn't by itself make a site Down, but it does show on the site's badge. The exception is a failed TLS handshake: the uptime check connects over HTTPS, so if the secure connection fails outright, the uptime check fails too and the site shows Down. See domain health check for which badge appears when.

How often we check

SSL checks run daily on the Free plan, every 12 hours on Starter and Pro, and every 6 hours on Business.

Understanding your SSL data

The Security page has three cards: Certificate details, Security checks and Check history.

Certificate details

This shows the key facts about your current certificate:

• Covers: the certificate's main name. The card doesn't list every hostname on the certificate (the SAN list). To see those, use openssl.
• Issued by: the certificate authority (like Let's Encrypt, Cloudflare, or DigiCert)
• Valid from / Expires: the start and end dates of your certificate's lifespan
• Protocol: the TLS version in use (like TLS 1.3)
• Chain: Trusted or Not trusted

Below these details, a Lifespan bar shows how far through its validity period your certificate is. As it gets closer to expiry, the bar changes colour.

Security checks

This is a checklist showing whether your certificate passes each of the checks described above. A green tick means the check passed. A red cross means there's a problem to look at.

When something needs attention

When a certificate moves into a warning state (for example, it's getting close to expiry), the Security page leads with an Insights summary: a plain-English explanation of what's happening and the steps to put it right.

Plan availability

Insights is available on Starter, Pro and Business. See the plan comparison.

Common SSL issues

When DomainDash flags an SSL problem, the troubleshooting section walks you through what's happening and how to fix it. The most common ones:

• Certificate expired — the most frequent SSL issue. Almost always a renewal step that didn't run.
• Hostname doesn't match certificate — your certificate was issued for a different domain than the one being served.
• Self-signed certificate — a placeholder certificate is being served instead of the real one.
• Certificate signed by an untrusted authority — the chain of trust is broken, often because an intermediate certificate is missing.
• Visitors see a security warning — if you're not sure which issue you have, start here.

See all SSL troubleshooting pages for the full list.

Frequently asked questions

How early does DomainDash warn me before my SSL certificate expires?

30 days. At 30 days or fewer the site's card on the dashboard shows "Renews · N days" unless a more serious badge applies, the site page header shows "Security expiring" while uptime is healthy and nothing more serious applies, and the site counts towards the dashboard's "Needs attention" filter. At 7 days or fewer DomainDash opens an incident at Worth knowing and the dashboard card reads "Alert" in place of "Renews · N days". At 1 day or less the incident rises to Needs a look. Once the certificate expires, a separate expired incident opens at Needs fixing. These incidents appear in the app and in the daily digest.

How often does DomainDash run SSL checks?

SSL checks run daily on the Free plan, every 12 hours on Starter and Pro, and every 6 hours on Business.

Does DomainDash check SSL certificates for subdomains?

DomainDash checks the exact domain you've added as a site. To check shop.example.com, add it as a separate site. Checks on example.com don't cover it, because SSL certificates are issued per hostname (unless the certificate is a wildcard or covers the subdomain via Subject Alternative Names).

What does "untrusted certificate chain" mean?

Every SSL certificate is signed by an intermediate certificate, which is signed by a root certificate that browsers trust. If any link in this chain is missing or invalid, browsers can't verify the certificate and show a security warning. The most common cause is a server configured to serve the leaf certificate without the intermediate. See Certificate signed by an untrusted authority for fixes.

Can DomainDash check self-signed certificates?

DomainDash detects self-signed certificates and flags them as a problem, because browsers don't trust them and visitors will see security warnings. Self-signed certificates are appropriate for internal testing but not for production sites. Switch to a free certificate from Let's Encrypt or a paid provider for public-facing sites.

Related

• Domain health check for how the uptime, SSL, DNS, and registration checks fit together
• Uptime checks for checking that your site is online and responding
• DNS health for checking your domain's routing configuration