Can a valid certificate still cause SSL warnings?

Yes. A certificate can be within its validity dates and still fail because the hostname does not match, the chain is incomplete, or the client does not trust the issuer.

Why do some users see the site and others do not?

Different devices, trust stores, cached intermediates, and network paths can produce different outcomes. Incomplete chains and edge-specific certificates are common reasons.

Does SSL Checker replace browser testing?

No. It gives a clean server-side view of certificate and protocol details, but browsers add their own policies, HSTS behavior, trust stores, and extension effects.

TLS and certificate trust

SSL errors explained

Understand the SSL and TLS problems that usually appear in diagnostics, including expired certificates, hostname mismatch, self-signed chains, protocol issues, and what each failure means for real users.

SSL errors sit in an awkward middle ground. The host may be reachable, the port may be open, and the website may even return content to some clients, yet browsers and crawlers can still block the page because trust failed before a normal HTTPS session was established. That is why certificate problems need their own interpretation instead of being lumped into “the site is down.”

Reachable is not the same as trusted

A server can answer on port 443 and still fail for users because the certificate is expired, mismatched, or untrusted.

Hostname matters as much as expiration

A fresh certificate is still wrong if it does not cover the hostname people actually requested.

TLS problems happen before normal page rendering

That is why SSL issues often look like downtime even when the application behind the server is running.

When SSL interpretation matters

Use this page when HTTPS trust is the actual blocker, not just a side note in a larger report.

Browsers show a certificate warning

Users may report a scary interstitial rather than a blank outage. The site can be alive while trust is broken.

Website Checker points to TLS failure

A dedicated SSL view helps separate certificate lifecycle issues from port reachability or application errors.

A migration or CDN change just happened

Hostname coverage, chain presentation, and edge-specific certificates often go wrong during DNS moves and platform changes.

Common SSL error families

These are the categories that explain most HTTPS trust failures in diagnostics.

Error family	What it usually means	What users typically experience
Expired certificate	The certificate validity window has ended and was not renewed in time.	Browsers block access or show a strong security warning.
Hostname mismatch	The requested host is not covered by the SAN list or common name.	HTTPS works only on some hostnames, or users see a certificate-name warning.
Self-signed or privately issued chain	The server presented a certificate that public clients do not trust by default.	Internal systems may work, but public browsers and bots reject the page.
Incomplete chain	The server did not present enough intermediates for clients to build trust cleanly.	Some devices succeed while others fail depending on cached intermediates.
Legacy or broken protocol negotiation	The endpoint only supports old TLS behavior or fails during handshake negotiation.	Connections fail before the page can load, especially on stricter clients.

How to separate SSL trouble from pure downtime

This distinction matters because the fix owner and urgency can change completely.

Port 443 can be open while HTTPS is still broken

A listening service only proves that something accepted a connection. It does not prove that the certificate chain or hostname trust is correct.

A valid certificate does not prove the app is healthy

The page can still return 500 or 503 after TLS succeeds. SSL is only one stage in the path.

Different hostnames can behave differently

The apex domain, www host, and a region-specific subdomain may each present different certificate coverage and edge behavior.

Best follow-up checks for SSL issues

Use the extra tool that answers the next layer of uncertainty instead of stopping at a generic browser warning.

Certificate and TLS inspectionOpen SSL Checker for the certificate view

Best for subject, issuer, SAN names, expiration, and visible protocol support on the exact hostname you care about.

SSL Checker URL diagnosticsOpen Website Checker to see whether the page still returns HTTP

Useful when you need the redirect chain, final URL, and timing context around the TLS warning.

Website Checker TCP reachabilityOpen Port Checker when you are not sure the HTTPS service is listening

This helps separate a dead listener from a trust problem on an otherwise reachable endpoint.

Port Checker Parsed DNS answersOpen DNS Lookup after hostname or edge changes

Helpful when a DNS move may have sent traffic to the wrong provider or a host that presents the wrong certificate.

DNS Lookup

Common SSL misconceptions

These assumptions make certificate incidents harder to diagnose than they need to be.

Assuming a site is fully down just because a browser shows a certificate warning.
Looking only at expiry dates and ignoring hostname coverage in the SAN list.
Testing an origin IP directly and expecting the result to represent the public hostname correctly.
Treating one client success as proof that the chain is healthy for every browser and device.