Do browsers still trust the certificates on my site?
Enter your domain. For each host we check who issued its certificate, whether browsers still trust that authority, and whether anything will break at the next renewal.
What this checks
- Certificates issued through intermediates revoked for key compromise (for example eMudhra's, October 2026), even when the server doesn't send the intermediate.
- Certificates from roots browsers distrust for new certificates (currently Entrust and AffirmTrust, Chunghwa Telecom and NetLock in Chrome), dated the way browsers date them.
- Servers that leave out their intermediate certificate, and CAA records that don't allow the authority you use.
- Certificates about to expire, renewals that look stuck, and which authorities issue certificates for your domain in public logs.
What it can't see
- Certificates on internal services or ports other than 443.
- Revocation of your own certificate: we check the authorities above it, not your certificate's revocation status.
Questions
What does it mean when browsers distrust a certificate authority?
When a certificate authority's keys are compromised or it breaks the rules, browsers stop accepting its certificates, sometimes all of them, sometimes only those issued after a date. Sites using it need a new certificate from another authority. A recent example: in October 2026 eMudhra reported that keys for several of its website-certificate intermediates were compromised; they were revoked, and Chrome, Firefox, Edge and Safari block certificates issued through them.
My site works in my browser. Why does this say there's a problem?
Some distrust rules apply only to certificates issued after a date, or only in some browsers (Chrome distrusts Chunghwa Telecom and NetLock certificates issued after 31 July 2025, Firefox doesn't). Others affect apps and API clients more than desktop browsers, like a missing intermediate. The finding names which browsers and clients are affected.
How do you keep the list up to date?
We follow the browsers' root-program announcements and add each new distrust or revocation, with its source, as it is announced.
Does this change my grade?
Only for a certificate that is broken now (distrusted, expired, an incomplete chain): those are graded like any certificate browsers reject. Warnings about the next renewal and good-practice tips never change the grade.