Health score

A valid certificate can still cause trouble: a missing intermediate, an old TLS version, a weak key. The health score sums it up in one number from 0 to 100, built from eight sub-scores, so you can see what to fix. Available on Starter and Pro.

Where to find it

• Domains shows the score and a small chart of recent checks for each domain.
• The domain's page shows the score, the breakdown, the history and How to improve this score, most urgent first.
• Click ↻ next to "Certificate health" to check again now. Otherwise it is checked every 30 minutes.

Colours: green from 75, amber from 50 to 75, red below 50.

The eight sub-scores

Sub-score	Points	What is checked
chain_trusted	20	Issued by a CA browsers trust. Self-signed or unknown CA: 0. Fatal.
hostname_match	15	The certificate covers your hostname. *.example.com covers a.example.com, not example.com or a.b.example.com. Fatal.
not_yet_valid	5	The start date has passed. If not, a clock is usually wrong. Fatal.
expiry_proximity	20	How much of the certificate's lifetime is left (see below).
revocation	10	The issuer has not revoked the certificate. Fatal.
chain_complete	10	The server sends its intermediate certificates.
tls_version	10	TLS 1.2 or 1.3, with 1.0 and 1.1 switched off. Half marks while they are still accepted.
weak_algorithms	10	SHA-256 or stronger, with an RSA key of at least 2048 bits or an EC key of at least 256 bits.
Total	100

Fatal problems cap the score at 20

Four problems are fatal: untrusted chain, wrong hostname, not yet valid, and revoked. Each one makes browsers refuse the site, so the score cannot go above 20, however good the rest is. The rest of the breakdown still shows which checks pass.

Expiry counts against the certificate's own lifetime

expiry_proximity stays at full marks while at least a third of the lifetime is left — that is when tools like certbot renew. After that it drops steadily to zero at expiry. So a 90-day Let's Encrypt certificate and a one-year certificate score the same when both are renewed on time.

Expiry caps the score in the last 30 days

The days before expiry also cap the whole score, at the same points where the domain's status turns warning and critical:

Days left	Highest possible score
more than 30	no cap
30 to 8	74 (amber)
7 to 0	49 at 7 days, falling to 20 on the last day (red)
expired	20 (fatal)

So a certificate that should have been renewed already can no longer look green, however good the rest of it is. The cap goes away on the first health check after the new certificate is served.

How to raise a low score

Problem	What to do
chain_trusted is 0	Self-signed or untrusted CA, common on staging hosts. Use a publicly trusted certificate.
hostname_match is 0	The certificate does not include the monitored name. Re-issue it with the right names.
revocation is 0	The issuer revoked it. Treat the key as compromised: new key, new certificate.
chain_complete is 0	The server sends only its own certificate. Serve the full chain (fullchain.pem with Let's Encrypt).
tls_version at half	TLS 1.0 or 1.1 is still accepted. Switch them off in the server configuration.
weak_algorithms is 0	SHA-1 signature or a short key. Re-issue the certificate.
expiry_proximity falling, or the score capped	Renewal is due. Check that it runs and that the server reloaded the new certificate.

An incomplete chain is the sneaky one: your browser has the intermediate cached and shows the site, while API clients and older devices cannot connect.

When something cannot be measured

You only lose points for problems CertWatchr has actually found:

• No revocation list in the certificate? Full marks for revocation.
• TLS 1.0/1.1 could not be tested? No points taken off.

API

The score, breakdown, suggestions and history are all in the API.