How to check your certificate installed correctly
Installing the certificate and seeing the padlock in your own browser is not enough to call the job done. Your browser lies to you out of convenience: it caches things a new visitor does not have, and shows you a working site that breaks for other people.
Checking from outside takes thirty seconds.
What to check
Open our SSL Checker, type your domain, and look at four things:
1. The certificate being served is the one you installed. This is the most common mistake of all, and it is invisible: you install the new file, you do not restart the service, and the server carries on handing out the old one. The expiry date gives it away immediately — if it is the old date, the restart is what is missing.
2. The chain is complete. If it says an intermediate is missing, your certificate is fine and what is missing is configuration. We cover it in what the CA bundle is.
3. The name matches the domain. A certificate for www.yourdomain.com does not cover bare yourdomain.com, and a *.yourdomain.com wildcard does not cover two levels of subdomain.
4. How long is left. At current lifetimes a certificate lasts about two hundred days. It is worth knowing where you are — we go into it in why your certificate expires before your order.
If the padlock still does not appear
A separate case: the chain is right, the certificate matches, and the browser shows a warning anyway. That is almost always mixed content — the page is served over HTTPS but asks for an image, a script or a stylesheet over HTTP, and the browser downgrades it.
Our why no padlock tool checks exactly that and tells you which resource is causing it.
The other tools
They are all at tools.tiendassl.com, free and without an account:
| Tool | What it is for |
|---|---|
| SSL Checker | What your domain is serving right now |
| Why no padlock | Finding mixed content |
| CSR decoder | Seeing which domain and details a CSR carries |
| Certificate decoder | Reading an issued certificate |
| Key and certificate matcher | Telling whether a .key belongs to a .crt |
| CSR generator | Creating a CSR without a command line |
| Format converter | Moving between PEM, DER, PKCS#7 and PFX |
| CAA record generator | Building the value for a CAA record |
When to check again
After installing, after every reissue, and after moving the site to a different server. Those are the three moments when a working site stops working without anyone noticing until a customer writes in.
