Troubleshooting
The certificate reading looks wrong
Why the certificate module can disagree with your host: when it was last read, Cloudflare's edge certificate, the app's own handshake, auto-renewing issuers, and subdomain and port certificates.
Updated · 4 min read
Every certificate DomainGuard shows was read from your server by our scanner in a real TLS handshake. When it looks wrong, it's almost always one of the cases below.
"It says 60 days but my host renewed yesterday"
On a paid plan the scanner reads each automatically watched domain once a day, so a renewal shows up within a day. On Free, and for a domain past the plan's automated allowance, the certificate is read when you scan. Press Scan now to read it sooner; the new reading usually lands a couple of minutes after the scan finishes. If it still shows the old certificate, your server is still handing out the old one. The usual cause is a web server that wasn't reloaded after the renewal.
"It shows a Google or Let's Encrypt certificate, but I bought one from someone else"
If the site is behind Cloudflare, visitors connect to Cloudflare, and Cloudflare presents its own edge certificate. That's what we read, because that's what your visitors get. The certificate you bought sits on your origin server behind Cloudflare.
"It says one certificate; my browser shows another"
The iOS app adds a second reading, "this device's own handshake", from its reachability check. If your phone and our scanner were handed different certificates, the host is serving more than one, usually a load balancer or CDN with a stale copy on one node. That disagreement is worth fixing.
"The reading is several days old"
The scanner couldn't reach the host since then (a timeout or a refused connection). We keep showing the last certificate read, with its date, for up to seven days, and then show it as not read. Check that the host is up and answers on port 443 from outside your network.
"It says the certificate is for a different name"
The certificate the server handed over doesn't list that hostname. Common causes: a subdomain pointed at a shared host that serves its own certificate, a www name missing from the certificate, or a wildcard that only covers one level (*.example.com covers shop.example.com, not a.shop.example.com).
"Incomplete certificate chain"
The server sends its certificate without the intermediate that links it to a trusted root. Most desktop browsers fill the gap themselves, so the site looks fine to you, but apps, scripts, payment and API clients and older phones refuse the connection. Configure the server with the full chain file (often fullchain.pem or a ca-bundle).
"HTTPS fails on a subdomain"
The name answers but ends the handshake before sending a certificate. On Cloudflare, the free certificate covers one level of subdomain, so a.b.example.com needs Advanced Certificate Manager or its own certificate. Elsewhere, install a certificate for that name or remove the DNS record.
"TLS 1.0 and 1.1 are still on"
Many hosts, and Cloudflare, leave them on by default. No current browser uses them, but PCI DSS and most cyber-insurance forms ask for them off. On Cloudflare: SSL/TLS, Edge Certificates, Minimum TLS Version, TLS 1.2.
"My Let's Encrypt certificate is 5 days from expiry and there is no warning"
Deliberate. Certificates from Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, Cloudflare and Amazon are renewed by a client that runs on its own, so a countdown is noise. The module, the findings, the widget and the alerts say nothing until one day is left, the day that means the renewal has failed.
"A subdomain is listed as expiring but I don't use it"
Every watched subdomain is read and listed soonest-to-expire first. If you don't use the host any more, remove its DNS record, or remove it from the watched list if it only clutters the view.
"A port I don't recognise has an expired certificate"
The port scan found a service listening there, and the scanner read its certificate. Admin panels (UniFi on 8443, a hosting control panel on 2083) and mail servers (993, 995) often keep a self-signed or forgotten certificate for years. Renew it on that service; it's separate from the website's certificate.
"The issuer is my own hostname"
A bug in app builds before 2026-09-12 named the site's hostname as the issuer on the handshake reading. Update the app.
"SSL expiry" alert threshold
notify_ssl_days defaults to 14 days for hand-renewed certificates and can be changed under Notification settings. Auto-renewing issuers ignore it and warn at one day.
Related
Keep reading
Related articles
- Certificate monitoringHow our scanner reads each certificate straight from your server every day, what it checks beyond the expiry date, subdomain and service-port certificates, and the quiet rule for certificates that renew themselves.Domains ·Updated
- Subdomain discovery and per-host resultsHow hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.Domains ·Updated
- Findings, carry-forward and dismissalsWhat a finding shows, why a finding from a heavier scan survives a lighter one, and the four reasons a finding, a software reading or an alert can be silenced.Vulnerabilities and exposure ·Updated