SSL
The SSL section analyzes the TLS/SSL certificate configuration of the monitored website and provides detailed information about the certificate's validity and technical specifications.
Some features and limits mentioned on this page vary by plan. Visit our Pricing page to review the plans.
Through this section, users can easily review:
- SSL certificate validity period
- Certificate provider
- TLS configuration
- Certificate chain
- Domain name matches
This analysis is critically important for the website to establish a secure HTTPS connection and for user data to be transmitted securely.
WebPixie checks the certificate currently served by the site daily.
The daily check connects using a fully-verifying TLS client: the served certificate chain must validate against the trusted root CA store and the hostname must match. If the certificate is untrusted, expired, self-signed, or hostname-mismatched, the handshake fails — no certificate data is produced for that check, and an SSL Check incident opens. The same happens when the connection times out or is refused. The incident resolves when a later check succeeds.
SSL Overview
At the top of the SSL screen, the general status and validity period of the certificate are displayed.
Expiration
Shows how long until the SSL certificate expires.
This section includes:
- Number of remaining days
- Date when the certificate will expire
- Visual duration indicator
This information is used to track the certificate renewal time.
As expiration approaches, WebPixie raises the incident severity in stages: MEDIUM at 15 days or less, HIGH at 7 days or less, and CRITICAL at 3 days or less. This escalation happens within the same incident — it doesn't close and reopen a new one as the tier changes — and a one-time re-notification is sent when the incident escalates into CRITICAL.
Certificate Technical Information
The technical specifications of the certificate are also shown in detail on the SSL screen.
Issuer
Shows the Certificate Authority (CA) information that provided the certificate.
Example
DigiCert Global CA G2 – DigiCert Inc.
Cipher
Shows the encryption algorithm used in the TLS connection.
Example
Cipher Strength
Shows the bit length of the encryption key.
This value indicates the cryptographic security level of the connection.
Protocol
Shows the TLS protocol version supported by the server.
Example
Key Exchange
Shows the key exchange mechanism used in the TLS connection.
Extended Key Usage (EKU)
Shows the Extended Key Usage OIDs declared on the certificate — the specific purposes the certificate is authorized for (e.g. server authentication, client authentication).
OCSP
Shows the Online Certificate Status Protocol address declared on the certificate.
WebPixie queries this endpoint to check whether the certificate has been revoked. A revoked certificate is flagged as a critical finding.
OCSP Stapling
Shows whether the certificate supports or requires OCSP stapling — a separate detail from the revocation-checking note above.
CRL Distribution Points
Shows the Certificate Revocation List addresses declared on the certificate.
When the OCSP responder is missing or gives no answer, WebPixie checks these addresses instead. A revoked result from either check is flagged as a critical finding.
Serial Number
The unique serial number of the SSL certificate.
Certificate Details
This section shows the domain name matches and creation information of the SSL certificate.
Subject
Shows the main domain name the certificate belongs to.
Example
Subject Alternative Names (SAN)
Lists all domain names covered by the certificate.
For example, a certificate can cover the following domain names:
Example
This way, a single SSL certificate can secure multiple domain names.
Signature Algorithm
Shows the cryptographic algorithm used when signing the certificate, covering RSA, EC/ECDSA, Ed25519, and Ed448 keys, along with the hash algorithm used.
Example
X.509 Version
Shows the X.509 certificate format version.
Created At
Shows the date when the certificate was created.
Expires
Shows the date when the certificate's validity will expire.
Multi-IP Consistency
If the domain resolves to multiple IP addresses (IPv4 and IPv6), WebPixie checks whether they all serve the same certificate. The certificate from the first resolved IP is treated as the reference; each additional IP is checked against it.
A different or non-working certificate on some IPs (for example, behind a load balancer) is surfaced here for review only — it does not open an incident or send a notification, but it does count as a finding against the SSL analysis and Site Score.
SSL Chain
The SSL Chain section shows the certificate's chain of trust.
This chain typically consists of three levels:
-
Leaf Certificate (Site Certificate) The certificate that directly belongs to the website.
-
Intermediate Certificate The intermediate Certificate Authority certificate that signed the certificate.
-
Root Certificate The top-level trusted Certificate Authority certificate.
WebPixie checks the chain's order, cross-signatures and validity dates.
This chain-consistency check (order, cross-signature validity between certificates, and date validity) is a separate, structural check on a chain that has already passed the trust handshake described above — it isn't the trust gate itself. A finding here is surfaced for review and doesn't by itself open an incident.
If the chain is properly configured, the system displays the following message:
Success
✔ SSL certificate chain is properly trusted
✔ Certificate is signed by a trusted Certificate Authority