SSL
The SSL section analyzes the TLS/SSL certificate configuration of the monitored website and provides detailed information about the certificate's validity, reliability, and technical specifications.
Through this section, users can easily review:
- SSL certificate validity period
- Certificate provider
- TLS configuration
- Certificate chain
- Domain name matches
This analysis is critically important for the website to establish a secure HTTPS connection and for user data to be transmitted securely.
WebPixie checks the certificate currently served by the site daily.
The daily check connects using a fully-verifying TLS client: the served certificate chain must validate against the trusted root CA store, the hostname must match, and TLS 1.2 or higher is required. If the certificate is untrusted, expired, self-signed, hostname-mismatched, or served only over a TLS version below 1.2, the handshake fails — no certificate data is produced for that check, and an SSL Check incident opens.
SSL Overview
At the top of the SSL screen, the general status and validity period of the certificate are displayed.
Expiration
Shows how long until the SSL certificate expires.
This section includes:
- Number of remaining days
- Date when the certificate will expire
- Visual duration indicator
This information is used to track the certificate renewal time.
As expiration approaches, WebPixie raises the alert severity in stages: MEDIUM at 15 days or less, HIGH at 7 days or less, and CRITICAL at 3 days or less. This escalation happens within the same incident — it doesn't close and reopen a new one as the tier changes — and a one-time re-notification is sent when the incident escalates into CRITICAL.
Certificate Technical Information
The technical specifications of the certificate are also shown in detail on the SSL screen.
Issuer
Shows the Certificate Authority (CA) information that provided the certificate.
Example
DigiCert Global CA G2 – DigiCert Inc.
Cipher
Shows the encryption algorithm used in the TLS connection.
Example
Cipher Strength
Shows the bit length of the encryption key.
This value indicates the cryptographic security level of the connection.
Protocol
Shows the TLS protocol version supported by the server.
Example
Key Exchange
Shows the key exchange mechanism used in the TLS connection.
Extended Key Usage (EKU)
Shows the Extended Key Usage OIDs declared on the certificate — the specific purposes the certificate is authorized for (e.g. server authentication, client authentication).
OCSP
Shows the Online Certificate Status Protocol address declared on the certificate.
WebPixie surfaces this endpoint for reference only. It does not query it to check whether the certificate has been revoked; OCSP-based revocation checking is on the roadmap.
OCSP Stapling
Shows whether the certificate supports or requires OCSP stapling — a separate detail from the revocation-checking note above.
CRL Distribution Points
Shows the Certificate Revocation List addresses declared on the certificate.
As with OCSP above, these addresses are surfaced for reference only. WebPixie does not currently query them to check for revocation.
Serial Number
The unique serial number of the SSL certificate.
Certificate Details
This section shows the domain name matches and creation information of the SSL certificate.
Subject
Shows the main domain name the certificate belongs to.
Example
Subject Alternative Names (SAN)
Lists all domain names covered by the certificate.
For example, a certificate can cover the following domain names:
Example
This way, a single SSL certificate can secure multiple domain names.
Signature Algorithm
Shows the cryptographic algorithm used when signing the certificate, covering RSA, EC/ECDSA, Ed25519, and Ed448 keys, along with the hash algorithm used.
Example
X.509 Version
Shows the X.509 certificate format version.
Created At
Shows the date when the certificate was created.
Expires
Shows the date when the certificate's validity will expire.
Multi-IP Consistency
If the domain resolves to multiple IP addresses (IPv4 and IPv6), WebPixie checks whether they all serve the same certificate. The certificate from the first resolved IP is treated as the reference; each additional IP is checked against it.
A different or non-working certificate on some IPs (for example, behind a load balancer) is surfaced here for review only — it does not open an incident or trigger an alert, but it does count as a finding against the SSL analysis and Site Score.
SSL Chain
The SSL Chain section shows the certificate's chain of trust.
This chain typically consists of three levels:
-
Leaf Certificate (Site Certificate) The certificate that directly belongs to the website.
-
Intermediate Certificate The intermediate Certificate Authority certificate that signed the certificate.
-
Root Certificate The top-level trusted Certificate Authority certificate.
WebPixie verifies the integrity of this chain and confirms whether the certificate is signed by a trusted authority.
This chain-consistency check (order, cross-signature validity between certificates, and date validity) is a separate, structural check on a chain that has already passed the trust handshake described above — it isn't the trust gate itself. A finding here is surfaced for review and doesn't by itself open an incident.
If the chain is properly configured, the system displays the following message:
Success
✔ SSL certificate chain is properly trusted
✔ Certificate is signed by a trusted Certificate Authority