How to check the certificate a website actually serves
Inspect certificate dates and hostnames, diagnose a renewal that did not reach the endpoint, and understand the limits of an SSL expiry check.
Check the visitor’s hostname
A certificate shown in a hosting control panel is not proof that the public endpoint serves it. Run SSL Checker for the hostname visitors use. Check the apex and www names separately if both are used, and include other public subdomains that have their own service.
A CDN, proxy, or load balancer may terminate TLS before a request reaches the origin server. If you renewed only the origin certificate, the edge can still present a different certificate. Write down the checked hostname and check time alongside the returned issuer, names, and validity dates.
Read each field as a separate piece of evidence
The validity window, identity, and trust of a certificate are separate concerns. Review the fields rather than treating days remaining as a complete security result. The example below is deliberately hypothetical; it describes how to investigate the result, not the current certificate of a real website.
| Observation | What it suggests | What to check next |
|---|---|---|
| Validity has already ended | The presented certificate is expired. | Inspect renewal and deployment to the public endpoint. |
| Validity has not started | The certificate is not yet valid at the check time. | Check dates and clocks, then the endpoint configuration. |
| SAN includes example.com only | www.example.com is not explicitly listed. | Verify the certificate covers the exact visitor hostname. |
| The edge and origin show different issuers | TLS may terminate in more than one place. | Review both configurations; different issuers alone do not prove an error. |
| Dates look valid, but browsers still warn | A date check has not explained the failure. | Investigate hostname matching and certificate-chain trust. |
Investigate a renewal that did not reach the endpoint
Compare the served certificate with the certificate your renewal job produced. Check whether the automated job completed, whether the domain challenge succeeded, and whether the renewed certificate reached the proxy or server that terminates TLS. Follow your provider’s reload or deployment procedure before checking again.
For a DNS challenge, verify the requested public TXT record rather than relying on a dashboard screenshot. For an HTTP challenge, inspect whether routing or redirects prevent the certificate authority from reaching the expected challenge response. A short remaining validity window is a reason to inspect the renewal workflow; it does not identify the cause by itself.
Understand what this checker establishes
ADEMN reports the certificate and dates it can observe from its server. It separately reports hostname and trust information in the diagnostic result; review any warnings. A valid window alone does not establish all TLS protocol settings, revocation status, cipher choices, or application security.
The result can differ from a browser because of location, address selection, caching, or network protection. Recheck the same public hostname after a change and use your certificate provider’s diagnostics when you need a deeper investigation. Never send a private key in a support report.