A certificate matters operationally when a service presents it to a client. SSLBoard connects to discovered endpoints and uses the observed certificates to build the deployment inventory, expiry information, and issuer distribution.
Results you may see
| Result | Meaning and response |
|---|---|
| Expired certificate served | An observed deployed certificate is past its validity period. Replace it on every affected endpoint and investigate renewal or deployment failure. |
| Near expiration | A deployed certificate is approaching its end date. Confirm renewal and deployment before it expires. The score distinguishes within 7 days from 8–15 days. |
| Revoked certificate served | The endpoint’s inspection reports a revoked certificate. Replace it promptly and investigate why it was revoked. |
| Certificate or chain error | Validation failed, possibly because of a hostname mismatch, incomplete chain, or trust problem. Read the error before choosing a fix. |
| Dates or status unavailable | The relevant evidence was not returned. This does not establish validity or a clean revocation status. |
The expiry distribution separates expired certificates, expiry within 7 days, within 8–15 days, within 16–30 days, and 31 days or more. Certificate inventory rows separately use an expiring-soon label below 30 days and an unknown state when a usable date is unavailable. These display bands are broader than the near-expiry penalties in the score.
Renewal must reach the serving endpoint
Issuing a replacement certificate is only part of the work. A proxy, load balancer, or one server in a pool can continue presenting the old certificate. Use the affected IP and port to check the deployment, including IPv6 where it appears in the report.
For example, if two addresses serve the same hostname and only one presents the expired certificate, replacing the file on the other server will not resolve the finding. Check where TLS terminates and whether the relevant process reloaded its configuration.
Issuers and certificate names
Issuer distribution helps you understand which certificate authorities appear in the observed inventory. A large number of issuers can be worth reviewing for operational consistency, but is not by itself evidence of a security problem.
Certificate names identify what the certificate covers. They do not establish that every listed name is live or owned by the same organization. See adjacent domains for those relationships and CAA policies for issuance restrictions.
Verify a replacement
Run a fresh retest and confirm that each affected endpoint presents the intended certificate, with the expected names and validity dates. Also review connection and certificate errors and OCSP stapling. A renewed certificate can still be deployed with the wrong chain or stale status response.