What the certificate proves
A TLS certificate binds a public key to a hostname, vouched for by a certificate authority your browser already trusts. When the connection succeeds, it proves you are talking to something holding the private key for that name, and it encrypts everything in transit.
It does not vouch for the organisation behind the site in any meaningful way. A domain-validated certificate -- which is most of them -- only proves control of the domain. Phishing sites have valid certificates routinely. A padlock means the connection is private, not that the site is honest.
Expiry, and why it catches people out
Certificate lifetimes have shortened steadily and continue to. Let's Encrypt issues for 90 days, and the industry is moving toward shorter still. Manual renewal at that cadence is not sustainable, so automation is effectively mandatory.
Treat fewer than 30 days remaining as time to confirm renewal is working, and fewer than 7 as urgent. An expired certificate produces a full-page browser warning that stops essentially all traffic -- it is among the most damaging and most preventable outages there is.
Common validation failures
A hostname mismatch means the certificate is valid but does not cover the name you used. Usually the certificate covers example.com but not www.example.com, or vice versa. A wildcard such as *.example.com covers one level of subdomain only -- it matches a.example.com but not b.a.example.com.
An incomplete chain is the failure that is hardest to spot, because it often works in browsers and fails elsewhere. Browsers cache intermediate certificates from previous visits, so a server that omits its intermediate may work fine for you and fail for API clients and mobile apps that have no such cache. Always serve the full chain.
Protocol versions
The report shows which protocol was negotiated. TLS 1.3 is current and preferred; TLS 1.2 remains acceptable and widely used. TLS 1.0 and 1.1 are deprecated, rejected by modern browsers, and fail PCI DSS compliance.
If a server negotiates only TLS 1.0 or 1.1, that is a configuration to fix promptly. Support for old protocols is usually a leftover from a configuration written years ago rather than a deliberate choice.
Frequently asked questions
How many days before expiry should I renew?
Automate it and renew at roughly a third of the lifetime remaining -- for a 90-day certificate, around day 60. That leaves room for a failed renewal to be noticed and fixed.
Why does my browser trust it but this tool reports an error?
Most often an incomplete chain. Your browser cached the intermediate certificate from an earlier visit; a fresh client has not, and fails. Configure the server to send the full chain.
Is a free certificate less secure than a paid one?
No. The encryption is identical. Paid certificates may offer organisation validation, warranties and support, but the cryptographic protection is the same.
What does the wildcard certificate cover?
Exactly one level of subdomain. *.example.com matches shop.example.com but not checkout.shop.example.com, and it does not match example.com itself unless that is listed separately.