Health score

A certificate can be "valid" and still be a problem: missing intermediates, old TLS versions, a weak key. The health score is a single 0–100 number that tells you how your certificate and TLS setup look to a visitor, built from eight sub-scores so you can see why. It is available on Starter and Pro.

Where to find it

• The Domains list shows the score and a small chart of recent checks beside each domain.
• The domain's page shows the score as a ring, the full breakdown, a chart of the score over time, and a what to fix list ordered by urgency.
• Press ↻ next to "Certificate Health" to re-check right now instead of waiting for the next scheduled check (every 30 minutes).

Colours: green 75 and above, amber 50–75, red below 50.

The eight sub-scores

Sub-score	Points	What we check
chain_trusted	20	The certificate is issued by a CA browsers trust. Self-signed and unknown-CA certificates score 0. Fatal.
hostname_match	15	The certificate covers the hostname you monitor. *.example.com covers a.example.com but not example.com or a.b.example.com. Fatal.
not_yet_valid	5	The certificate's start date has passed. Usually a clock problem. Fatal.
expiry_proximity	20	How much of the certificate's own lifetime is left. See below.
revocation	10	The certificate is not on its issuer's revocation list. Fatal.
chain_complete	10	The server sends its intermediate certificates, not only its own.
tls_version	10	TLS 1.2 or 1.3 is used, and TLS 1.0/1.1 are no longer accepted. Half marks if they still are.
weak_algorithms	10	SHA-256 or stronger signature, over a key of at least 2048-bit RSA or 256-bit elliptic curve.
Total	100

Fatal problems cap the score at 20

Four sub-scores are fatal: an untrusted chain, a hostname mismatch, a certificate that is not yet valid, and a revoked one. Any of them means every browser refuses the connection — the site is down for your visitors — so the total is capped at 20 no matter how good everything else is. The cap is not 0 so that the breakdown underneath still tells you which of the other checks pass.

Expiry is measured against the certificate's own lifetime

expiry_proximity keeps full marks while at least a third of the certificate's lifetime is left — that is when automated renewal tools such as certbot normally renew — and then falls steadily to zero at expiry. A 90-day Let's Encrypt certificate renewed on schedule therefore scores the same as a one-year certificate renewed on schedule, and the score never jumps on a particular calendar day.

How to raise a low score

The domain's page lists what to fix, most urgent first. The common ones:

• chain_trusted = 0: self-signed, or from a CA browsers do not trust. Common on internal and staging hosts. Use a publicly trusted certificate.
• hostname_match = 0: the certificate does not include the name you monitor, e.g. it lists example.com but you monitor api.example.com. Re-issue with the right names.
• revocation = 0: the issuer has revoked this certificate. Treat the private key as compromised — generate a new key and a new certificate.
• chain_complete = 0: the server sends only its own certificate. It works in your browser, which has the intermediate cached, and fails for many API clients and older devices. Serve the full chain (fullchain.pem with Let's Encrypt).
• tls_version at half marks: TLS 1.0 or 1.1 are still accepted. Disable them in the server configuration.
• weak_algorithms = 0: a SHA-1 signature, or a key below 2048-bit RSA / 256-bit EC. Re-issue.
• expiry_proximity falling: renewal is due. If it is automated, check that it is running and that the server reloaded the new certificate.

Notes on what is measured

• A certificate that names no revocation list scores full marks for revocation. Points are only taken off when a certificate is positively known to be revoked.
• If TLS 1.0/1.1 support could not be tested, no points are deducted. A check that could not be made is not counted against you.

API

The score, breakdown, suggestions and history are all available programmatically. See API.