Expiry is only one check
A certificate’s validity dates show its time window. They do not establish that the hostname matches or that the certificate chain can be verified. A certificate can be unexpired and still fail a live TLS check.
Understand the chain
A leaf certificate identifies the endpoint and is commonly issued through intermediate certificates. Certificate chain could not be verified means the check could not establish a valid trust path. The error alone does not identify the exact missing or incorrect certificate.
Choose the right tool
Use SSL Certificate to inspect the certificate a website currently presents. Use Certificate Decoder to inspect a PEM or DER file locally. Compare subject alternative names, issuer and dates. Decoding a file does not validate the live connection.
Continue investigating other findings
DNS and network checks remain useful when TLS verification fails. If HTTP observations are collected with certificate verification bypassed, treat them as observations of the response; they do not demonstrate a trusted connection.
Example
Illustrative findings Validity dates: within range Hostname: review subject alternative names Certificate chain: could not be verified Conclusion: expiry alone is insufficient.
What to check next
- Check the exact hostname and IP version used by the live test.
- Review the chain presented by the target and its required intermediate certificates.
- After configuration changes, rerun the live SSL check. Inspect HTTP and DNS results independently.