The certificate is what makes the padlock appear in the browser. If it expires or doesn't match the address, visitors see a full-page warning instead of your site, and most of them leave.
What WP Moo looks at
What the problems mean
Out of the box: Urgent when invalid or within 3 days of expiry · Important within 7 days · Notice within 14 days. What each priority means: Problem priority.
How to fix it
For your developer
The check reads the certificate and chain from the TLS handshake of the Home page's latest page check, on the address the Home page ends on after its redirects, with SNI set to that host. To see the same thing:
openssl s_client -connect example.com:443 \
-servername example.com -showcerts </dev/null
The certificate counts as invalid when it has expired, isn't valid yet, doesn't match the host name, or the chain doesn't lead to a trusted root. A missing intermediate certificate is the most common cause of a broken chain: desktop browsers often fill the gap themselves, phones and API clients don't. Host names are matched against the subject alternative names only, and a wildcard covers one label. If we can't run the chain check, the chain stays unknown and doesn't count against the certificate.
Something unclear on this page? Email [email protected]