SSL Checker

Probably not — that's the modern normal. Let's Encrypt and most automated issuers use 90-day certificates by design (short lifetimes limit damage from key compromise and force automation), so a healthy auto-renewing site perpetually shows 1–60 days remaining. The actionable signal is a certificate under ~30 days when you know renewal should have already happened — automated systems typically renew at the 30-day mark, so 20-and-falling means the automation is stuck: check the renewal cron/service before it becomes a browser-warning incident.

The certificate is valid but doesn't cover the exact name you connected to — certificates only protect names explicitly listed in their SAN field. The classic: a cert for example.com that doesn't list www.example.com (or vice versa), so one form of the URL warns while the other works. Wildcards (*.example.com) cover one level of subdomain but not the bare domain unless it's also listed. The 'Covers' line in the result shows the actual list; if your name isn't on it, that's the whole bug.

The frequent flyers: 'unable to verify the first certificate' or 'unable to get local issuer' — the server isn't sending the intermediate certificate chain (a server config issue; browsers often paper over it, strict clients don't); 'certificate has expired' — renewal failed, see above; 'self-signed certificate' — fine for internal/dev, wrong for public sites; 'hostname mismatch' — see the SAN answer. Almost all of these are configuration problems on the site's side, fixable in minutes once named — which is what this checker is for.

No — and this distinction protects people. A valid certificate proves one thing: your connection to that hostname is encrypted and you're talking to whoever controls that domain. It says nothing about whether they're honest — phishing sites overwhelmingly have valid HTTPS now, because certificates are free and automated. The padlock means 'private conversation,' not 'trustworthy counterparty.' Judging the counterparty is a different toolkit: domain age (the WHOIS lookup), the offer's plausibility, and where the link came from.