# SSL certificate monitoring and TLS checks

Source: https://pingy.io/features/ssl-certificate-monitoring

Check the certificate your visitors receive.

An HTTPS endpoint can answer while serving an expired certificate, the wrong hostname or an incomplete chain. Pingy inspects the certificate presented by your website and records the trust, identity and security settings behind the connection. Open the individual findings to understand the grade.

## Certificate identity and expiration

Renewal automation still needs verification. A new certificate in a hosting control panel does not establish that the public endpoint is serving it. Pingy checks the certificate reached by the scanner and keeps certificate snapshots for comparison.

### Validity dates and days remaining

The not-before and not-after dates, remaining lifetime and total validity period.

See an approaching expiration or a certificate that is already expired.

### Issuer and provider

The issuing certificate authority and recognized provider.

Confirm the issuer after a migration and investigate unexpected changes.

### Hostname and SAN matching

The subject common name, subject alternative names and a match check for the monitored hostname.

Find a certificate installed for a different site, or missing coverage for a subdomain.

### SHA-256 fingerprint

A fingerprint identifying the certificate presented during the scan.

Distinguish a changed certificate from an unchanged certificate with similar names and dates.

### Public key and signature

Key type, key length and the certificate signature algorithm.

Review weak key sizes or signatures and verify the certificate issued by your provider.

## Verify the certificate chain

The server needs to present a usable path to a trusted issuer. Pingy captures the served certificates and performs a separate trust verification. A failed trust check deserves attention even when the expiry date looks healthy.

### Trust and self-signing

Whether verification succeeds and whether the leaf certificate is self-signed.

Identify a trust failure that visitors may encounter before they reach the page.

### Served chain and completeness

Certificate subjects, issuers, expiration dates and chain length, with completeness and issue details.

Find a missing intermediate or another chain configuration problem.

### OCSP stapling and revocation

Available stapled OCSP information and revocation results.

Inspect the status evidence available to the scanner. An unavailable response is not proof that a certificate is unrevoked.

### Certificate transparency

The count of embedded signed certificate timestamps found in the certificate.

Check for embedded transparency evidence. This is not a search of every transparency log.

## TLS and HTTPS policy

The report records the negotiated connection and probes modern protocol support. Use it to review a server change, then inspect any unavailable checks separately. Pingy's grade is its own summary of the collected evidence, not an SSL Labs score or a full vulnerability assessment.

### TLS 1.2 and TLS 1.3

Whether the scanner can negotiate each supported modern protocol.

Check compatibility after changing a reverse proxy, CDN or web server.

### Negotiated cipher

The protocol, cipher name and cipher strength used by the scanner's connection.

See the connection actually established. The report does not enumerate every supported cipher.

### Legacy protocol test state

Whether older protocol probes could be performed in the scanner environment.

Keep an untested protocol distinct from a confirmed disabled protocol.

### HSTS

The Strict-Transport-Security header, max-age, includeSubDomains and preload directive.

Review the browser policy for future HTTPS connections. A preload directive does not establish inclusion in a browser preload list.

### CAA alignment

Published CAA records and their alignment with the detected issuer when evaluable.

Investigate authorization policy that may interfere with certificate issuance or renewal.

## After replacing a certificate

Open the report for the exact hostname visitors use. Check the fingerprint and validity dates, then confirm hostname matching and chain trust. A renewed apex certificate may still leave www or another subdomain uncovered.

Review the TLS and HSTS findings after changing the web server or CDN. HSTS applies to browsers that receive the policy, so enabling it across subdomains needs a deliberate HTTPS rollout.

## Scheduled monitoring

Pro and Enterprise audit SSL certificates daily. Scheduled alerts cover worsening expiry thresholds, issuer changes, loss of trust and detected revocation. Renewal events appear in monitoring history. Public checks provide a snapshot without enrolling the site in ongoing monitoring.

## Will Pingy renew my certificate?

No. Pingy monitors the certificate and reports changes. Renewal and installation remain with your hosting provider, certificate automation or server administrator.

## Why can a valid certificate have a lower grade?

Validity is one part of the report. Key strength, trust, hostname coverage, supported protocols and HSTS also affect the assessment. Read the individual notes rather than relying only on the letter.

## Does this test every browser and every server behind a CDN?

No. The scan describes the endpoint and certificate reached during collection. Different edges, clients or routes can receive different configurations.

[HSTS browser behavior (MDN)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security)