SSL certificates: what "checking" a site actually verifies

The padlock icon in a browser's address bar gets read as a general trust signal — "this site is safe." What it actually confirms is much narrower: the connection between your browser and that server is encrypted, and the certificate presented was issued by a certificate authority your browser trusts. That's it. It says nothing about whether the site itself is trustworthy, and phishing sites have used valid SSL certificates for years.

What a certificate actually verifies

• Encryption in transit — data between browser and server can't be read or modified by anyone intercepting the connection.
• Domain ownership (for the most common certificate type) — the certificate authority confirmed whoever requested the certificate controls that domain, nothing more.
• Validity period — certificates expire, and an expired one triggers a browser warning even if everything else about the site is fine.

What it does not verify

It doesn't verify the operator's identity for the most common certificate type (domain-validated), doesn't verify the site's content is legitimate or safe, and doesn't verify the site isn't malicious. Extended Validation certificates used to add a stronger identity check and a visibly different browser indicator, but most major browsers have phased out the distinct EV visual treatment, so in practice it's not something most users can see anymore.

What actually breaks when a certificate is misconfigured

• Expired certificate — browsers block access with a full-page warning; most visitors leave rather than click through.
• Mismatched domain — the certificate was issued for a different hostname than the one being visited, often from a misconfigured subdomain.
• Incomplete chain — the server didn't send the intermediate certificates linking it back to a trusted root, which some browsers tolerate and others don't.
• Mixed content — an otherwise secure page loading some resources over plain HTTP, which browsers flag or block.

Checking a certificate before it causes a visible problem is worth doing periodically, especially on domains where renewal isn't automated. Processa's SSL checker shows the issuer, expiration date, and full certificate chain for any domain, and flags mismatches before your visitors see a warning page instead of your site.