TLS certificate guide
Read certificate names, dates, and verification results. Confirm that a renewed certificate is actually being served.
PPORT ·
Quick start
- Check the hostname users access.
- Review dates, names, and verification.
- Check the live certificate after renewal.
TLS and certificates
TLS protects a connection. A certificate binds a name to a public key. “SSL certificate” is a common label, but modern HTTPS uses TLS. A valid certificate does not guarantee trustworthy content or operators.
Read the certificate
| Field | What to check |
|---|---|
| Validity dates | Check both the start and end date. Remaining days are rounded down. |
| SAN / hostname | Check whether the certificate covers the requested name. |
| Verification | Based on this server’s trust store and TLS environment; read the associated error. |
| TLS version and cipher | Values negotiated for this connection, not a full list of supported combinations. |
Verify automatic renewal
- Check the expiration date served by the live endpoint.
- Review the renewal job and recent success or failure logs.
- Confirm that the DNS or HTTP validation path still works.
- Confirm that the web server or proxy loaded the renewed files.
CDN and origin certificates
A CDN may terminate TLS and present its own certificate while using another certificate at the origin. Renewing one does not prove that both paths are correct. Trust stores and connection locations can also affect verification.
Compare the file with the served certificate
A renewed file does not prove public HTTPS serves it. The first command reads a PEM file on disk; the second connects to port 443 and displays leaf certificate information. Replace example.com and the path, then compare subject, issuer, dates and SHA-256 fingerprint.
s_client -servername supplies the host through SNI. This pipeline inspects certificate details; it does not establish successful hostname and trust-chain validation. A CDN or load balancer may legitimately serve a different certificate from the origin file. Identify the TLS termination point first.
openssl x509 -in /path/to/fullchain.pem -noout -subject -issuer -dates -fingerprint -sha256openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -fingerprint -sha256Narrowing a certificate error
For expiry errors, check both validity dates and the device clock. For a name mismatch, inspect SAN against the name actually used. For trust errors, inspect intermediate certificates and the client trust store. A valid certificate does not rule out HTTP or application login errors.
Illustration: a renewed file has a new expiry, but the external response still has the old one. Investigate the configured file path, proxy layer and reload state. Compare the served certificate before repeatedly reissuing it. Validate the service configuration before reloading after a change.