SSL certificate monitoring and TLS checks

Check the certificate your visitors receive.

An HTTPS endpoint can answer while serving an expired certificate, the wrong hostname or an incomplete chain. Pingy inspects the certificate presented by your website and records the trust, identity and security settings behind the connection. Open the individual findings to understand the grade.

View the live report Check your site

Pingy certificate report with validity dates, issuer, hostname matching and key strength — Certificate identity and validity from the pingy.io report. The security checks below the overview explain the grade.

Certificate identity and expiration

Renewal automation still needs verification. A new certificate in a hosting control panel does not establish that the public endpoint is serving it. Pingy checks the certificate reached by the scanner and keeps certificate snapshots for comparison.

Validity dates and days remaining: The not-before and not-after dates, remaining lifetime and total validity period.; Why it mattersSee an approaching expiration or a certificate that is already expired.
Issuer and provider: The issuing certificate authority and recognized provider.; Why it mattersConfirm the issuer after a migration and investigate unexpected changes.
Hostname and SAN matching: The subject common name, subject alternative names and a match check for the monitored hostname.; Why it mattersFind a certificate installed for a different site, or missing coverage for a subdomain.
SHA-256 fingerprint: A fingerprint identifying the certificate presented during the scan.; Why it mattersDistinguish a changed certificate from an unchanged certificate with similar names and dates.
Public key and signature: Key type, key length and the certificate signature algorithm.; Why it mattersReview weak key sizes or signatures and verify the certificate issued by your provider.

Verify the certificate chain

The server needs to present a usable path to a trusted issuer. Pingy captures the served certificates and performs a separate trust verification. A failed trust check deserves attention even when the expiry date looks healthy.

Trust and self-signing: Whether verification succeeds and whether the leaf certificate is self-signed.; Why it mattersIdentify a trust failure that visitors may encounter before they reach the page.
Served chain and completeness: Certificate subjects, issuers, expiration dates and chain length, with completeness and issue details.; Why it mattersFind a missing intermediate or another chain configuration problem.
OCSP stapling and revocation: Available stapled OCSP information and revocation results.; Why it mattersInspect the status evidence available to the scanner. An unavailable response is not proof that a certificate is unrevoked.
Certificate transparency: The count of embedded signed certificate timestamps found in the certificate.; Why it mattersCheck for embedded transparency evidence. This is not a search of every transparency log.

TLS and HTTPS policy

The report records the negotiated connection and probes modern protocol support. Use it to review a server change, then inspect any unavailable checks separately. Pingy's grade is its own summary of the collected evidence, not an SSL Labs score or a full vulnerability assessment.

Individual Pingy SSL checks for trust, hostname matching, protocol support and security policy — Inspect each security result to see what passed, failed or could not be tested.

TLS 1.2 and TLS 1.3: Whether the scanner can negotiate each supported modern protocol.; Why it mattersCheck compatibility after changing a reverse proxy, CDN or web server.
Negotiated cipher: The protocol, cipher name and cipher strength used by the scanner's connection.; Why it mattersSee the connection actually established. The report does not enumerate every supported cipher.
Legacy protocol test state: Whether older protocol probes could be performed in the scanner environment.; Why it mattersKeep an untested protocol distinct from a confirmed disabled protocol.
HSTS: The Strict-Transport-Security header, max-age, includeSubDomains and preload directive.; Why it mattersReview the browser policy for future HTTPS connections. A preload directive does not establish inclusion in a browser preload list.
CAA alignment: Published CAA records and their alignment with the detected issuer when evaluable.; Why it mattersInvestigate authorization policy that may interfere with certificate issuance or renewal.

After replacing a certificate

Open the report for the exact hostname visitors use. Check the fingerprint and validity dates, then confirm hostname matching and chain trust. A renewed apex certificate may still leave www or another subdomain uncovered.

Review the TLS and HSTS findings after changing the web server or CDN. HSTS applies to browsers that receive the policy, so enabling it across subdomains needs a deliberate HTTPS rollout.

Common questions

Will Pingy renew my certificate?

No. Pingy monitors the certificate and reports changes. Renewal and installation remain with your hosting provider, certificate automation or server administrator.

Why can a valid certificate have a lower grade?

Validity is one part of the report. Key strength, trust, hostname coverage, supported protocols and HSTS also affect the assessment. Read the individual notes rather than relying only on the letter.

Does this test every browser and every server behind a CDN?

No. The scan describes the endpoint and certificate reached during collection. Different edges, clients or routes can receive different configurations.

Technical reference

HSTS browser behavior (MDN)

Choose your monitoring plan.

Pro and Enterprise audit SSL certificates daily. Scheduled alerts cover worsening expiry thresholds, issuer changes, loss of trust and detected revocation. Renewal events appear in monitoring history. Public checks provide a snapshot without enrolling the site in ongoing monitoring.

Free

Keep an eye on personal sites.

$0up to 5 sites
per month

Start free

Website checks: Hourly (best-effort)
Monitoring regions: 1 region per siteChoose from 12 global stations
Scheduled DNS reports: Not included
SSL & domain reports: Not scheduled
Notification channels: EmailIntegrations not included

Pro

Daily reports

Faster checks and scheduled reports.

$3.99per site
per month

Choose Pro

Website checks: Every 3 minutes
Monitoring regions: 5 regions per siteChoose from 12 global stations
Scheduled DNS reports: Every hour
SSL & domain reports: Every day
Notification channels: EmailApprise integrations included

Enterprise

Our fastest checks and widest coverage.

$9.99per site
per month

Choose Enterprise

Website checks: Every minute
Monitoring regions: 8 regions per siteChoose from 12 global stations
Scheduled DNS reports: Every hour
SSL & domain reports: Every day
Notification channels: EmailApprise integrations included

Screenshots and SEO data on every plan.

Plans apply per site. Mix Free, Pro and Enterprise in one account. Free needs no card.

Just need a report?

Run 3 free public checks per 24 hours, including DNS, SSL, domain details and a screenshot. Scheduled audits are included with Pro and Enterprise.

Check your site