SSL certificate checks

What's checked

Every 6 hours Pingerer connects to your site on port 443 (or the port you set) and reads the certificate the way a browser would. The check fails when:

• the certificate has expired;
• it's for a different name (for example, it covers www.example.com but not example.com);
• it isn't trusted: self-signed, from an unknown issuer, or missing an intermediate certificate in the chain.

Expiry reminders

By default you're reminded 30, 14 and 3 days before expiry; change these on the monitor. A reminder makes the site degraded, not down, and each closer step sends one more alert. Renewing resolves it on the next check.

Fixing common problems

• Expiring soon, but it renews automatically? Let's Encrypt and most hosts renew about 30 days before expiry. If you get the 14-day reminder, automatic renewal probably failed: check your host's dashboard or certbot renew --dry-run.
• Name mismatch. Reissue the certificate to include every name visitors use, often both the bare domain and www.
• Untrusted / chain incomplete. Install the full chain (your certificate plus the intermediate), not just your certificate. Some browsers hide this problem; phones and other servers don't.