dnsWhat we check
- Trust – whether the certificate chains to a root that browsers trust.
- Ім’я хоста – whether the name you entered is listed in the certificate.
- Expiry – days remaining. Let’s Encrypt certificates last 90 days or less and should renew automatically about 30 days before expiry.
- Chain – each certificate the server sends. A missing intermediate works in some browsers and fails in others.
- Протокол – the TLS version and cipher negotiated.
Common fixes
“Unable to verify the first certificate” – serve the full chain (fullchain.pem), not just the leaf certificate. Host name mismatch – issue a certificate that includes this exact name, or a wildcard. Expired – check your ACME client’s renewal logs and any Записи CAA.
