Domains
Certificate monitoring
Where certificate data comes from, what the Certificate module shows, subdomain certificates, and the quiet rule for certificates that renew themselves.
Updated · 2 min read
The Certificate module shows a days-left ring, the expiry date, the issuer, the source of the reading, chain trust, HSTS, renewal history, and every watched subdomain's own certificate soonest-to-expire first.
Where the reading comes from
A Cloudflare Worker cannot open a raw TLS socket, so the server cannot see the certificate a host is presenting. Instead it reads Certificate Transparency logs: the public record of every certificate a CA issues. The newest unexpired certificate covering the name is the one a correctly configured host is almost certainly serving, and the module says "from certificate logs" so you know it is an inference.
The iOS app adds a second source: during its own reachability check the phone completes a TLS handshake and records the issuer it saw. The module labels that reading "this device's own handshake".
Subdomain certificates
Every host found by subdomain discovery has its certificate read on each scan. The Certificate module lists them soonest-to-expire first, so a lapse on mail. or shop. is seen even when the main site renews itself.
The quiet rule for auto-renewing issuers
A certificate from Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, Cloudflare or Amazon is renewed by a client that runs on its own, so a countdown on one is noise. For those issuers the module, the domain's findings, the widget and the server's expiry emails say nothing until the certificate has one day left, the one day that means renewal has failed.
Hand-renewed certificates (a paid certificate from another CA) get the normal warnings: the web treats 14 days or fewer as bad, and the app raises its seven-day and three-day notices. The SSL expiry notification threshold in Settings defaults to 14 days.
Renewal history
When a scan sees a new certificate, the previous one moves into the renewal history with its issuer and dates. This is the record to hand an auditor.
Chain trust and HSTS
The security checkup records whether the chain validates and whether Strict-Transport-Security is sent. Both appear on the Certificate module as facts rather than scores.
Common questions
The module says my certificate expires in 60 days but my host says it just renewed. CT logs record issuance, and a new certificate appears in them within minutes of issue. Run Scan now; if it still shows the old one, the renewal may not have completed at the CA.
The app's handshake issuer differs from the CT issuer. The host is serving a different certificate than the newest logged one, which usually means a stale deployment. Both readings are shown so you can see the disagreement.
Why is my Let's Encrypt certificate not warning me at 7 days? Because it is not supposed to. If it reaches one day, that is the signal that the ACME client has stopped working, and that is when the alert fires.
Keep reading
Related articles
- Subdomain discovery and per-host resultsHow hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.Domains ·Updated
- The certificate reading looks wrongWhy the certificate module can disagree with your host: logs record issuance not presentation, the app's own handshake, auto-renewing issuers, subdomain certs.Troubleshooting ·Updated
- MX, MTA-STS, TLS-RPT and BIMIWhere your mail is delivered, the records that force encrypted delivery and report on failures, and the optional brand-logo record.Email authentication ·Updated