Troubleshooting
The certificate reading looks wrong
Why the certificate module can disagree with your host: logs record issuance not presentation, the app's own handshake, auto-renewing issuers, subdomain certs.
Updated · 2 min read
"It says 60 days but my host renewed yesterday"
The server reads Certificate Transparency logs, which record every certificate a CA issued. A renewal appears there within minutes of issuance. Run Scan now. If the module still shows the old certificate, the renewal did not complete at the CA; check the host's certificate panel.
"It says one certificate; my browser shows another"
CT records issuance; a host may present an older certificate than the newest logged one (a stale deployment, a load balancer with its own copy). The iOS app adds a second reading, "this device's own handshake", from its reachability check. When the two disagree, the host is serving something other than the newest issued certificate, which is usually the finding you want.
"The issuer is my own hostname"
A bug in builds before 2026-09-12 named the site's hostname as the issuer on the handshake reading. Update the app.
"My Let's Encrypt certificate is 5 days from expiry and there is no warning"
Deliberate. Certificates from Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, Cloudflare and Amazon are renewed by a client that runs on its own, so a countdown is noise. The module, the findings, the widget and the expiry emails say nothing until one day is left, the day that means the renewal has failed.
"A subdomain is listed as expiring but I do not use it"
Every watched subdomain's certificate is read and listed soonest-to-expire first. A host that no longer serves anything can still hold a logged certificate; if the host is Gone in the Subdomains module, the certificate does not matter. Remove it from the watched list if it clutters the view.
"Chain trust failed"
The security checkup could not validate the chain the host presented, usually a missing intermediate. Fix it at the host; the next checkup clears it.
"SSL expiry" alert threshold
notify_ssl_days defaults to 14 days for hand-renewed certificates and can be changed under Notification settings. Auto-renewing issuers ignore it and warn at one day.
Related
Keep reading
Related articles
- Subdomain discovery and per-host resultsHow hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.Domains ·Updated
- Certificate monitoringWhere certificate data comes from, what the Certificate module shows, subdomain certificates, and the quiet rule for certificates that renew themselves.Domains ·Updated
- No DMARC reports are arrivingWhy a DMARC setup can look finished and receive nothing: the rua= address, the record location, a provider wizard, the 48-hour wait, and what to check in order.Troubleshooting ·Updated