TLS & Certificates

The TLS & Certificates tab inspects the certificate presented by each host encountered during a crawl. It reports protocol versions, chain validity, expiry windows, and subject alternative names so you can confirm that every domain the site touches is serving a valid, current certificate.

Running an inspection

Certificate inspection is separate from crawling. After a crawl completes, the tab shows one of three states depending on what has happened so far:

State	What you see
Not inspected	A Check certificates button. No inspection has run yet for this crawl. Click it to connect to every distinct host and retrieve its certificate chain.
Not HTTPS	A notice that the crawled site does not use HTTPS. There is no certificate to inspect. If you expected HTTPS, that is itself a finding.
Inspections list	One row per host, each showing a validity badge, a protocol badge, and a re-check button.

Each host row in the inspections list shows two badges. The first is a validity badge: Valid when the full chain verifies successfully, or Invalid when it does not. The second is a protocol badge showing the negotiated TLS version — typically TLS 1.3 or TLS 1.2.

When a certificate fails validation, the error message from rustls is shown verbatim beneath the host row. These messages are deliberately unedited: they name the exact failure reason the TLS library reported, which is the string you need when searching for a resolution or sharing with your hosting provider.

The Re-check button on each row re-connects to that single host and refreshes its certificate data. Use it after rotating a certificate or updating a configuration, without re-running the full inspection.

Certificate details

Expanding a host row reveals the certificate details table. Every field comes directly from the leaf certificate presented by the server.

Field	What it shows
Subject	The Common Name (CN) from the certificate's subject field. For most modern certificates this matches the primary domain.
Issuer	The organization that signed the certificate — typically the certificate authority (e.g. Let's Encrypt, DigiCert, Sectigo).
Valid from	The date the certificate became valid (`notBefore`).
Valid to	The date the certificate expires (`notAfter`), followed by the number of days remaining until expiry. A certificate that has already expired shows a negative count.
Covers	The Subject Alternative Names (SANs) listed on the certificate. These are the hostnames the certificate is valid for. A wildcard entry like `*.example.com` covers one level of subdomain.
Chain length	The number of certificates in the chain returned by the server, from the leaf through any intermediates to the root. A chain of 1 means the server sent only the leaf certificate, which may cause validation failures on clients that do not have the intermediate cached.

Findings

The tab generates findings for conditions that need attention. Each finding carries a severity badge indicating how urgently it should be addressed.

Finding	Severity	Meaning
Expired certificate	Critical	The certificate's `notAfter` date is in the past. Browsers will show a full-page warning and most visitors will leave. Search engines may drop the page from the index.
Expiring soon	Warning	The certificate expires within 14 days. If automatic renewal is not in place, this becomes a critical finding once the date passes.
Weak protocol	Notice	The server negotiated TLS 1.0 or TLS 1.1, both of which are deprecated. Modern browsers either reject them outright or show security warnings. TLS 1.2 is the minimum acceptable version; TLS 1.3 is preferred.

When to use this tab

Three situations where a certificate inspection is most valuable:

Before a migration to HTTPS. Run an inspection against the new configuration to confirm that every host in the crawl is reachable over TLS with a valid certificate before you redirect traffic.
After a certificate rotation. Use the re-check button on the affected host to verify that the new certificate is in place, the chain is complete, and the SAN list covers every domain you expect.
As part of a regular security audit. A periodic inspection catches certificates drifting toward expiry, hosts that have fallen back to older protocol versions, and new subdomains that were added to the crawl but not to the certificate.