{
  "host": "example.com",
  "port": "443",
  "leaf": {
    "subject": "example.com",
    "issuer": "Cloudflare TLS Issuing ECC CA 3 (SSL Corporation)",
    "sans": [
      "example.com",
      "*.example.com"
    ],
    "not_before": "2026-09-26T22:49:11Z",
    "not_after": "2026-12-25T22:56:35Z",
    "days_left": 66,
    "serial": "1EEE6AABB521D5E14FC315FD9985690",
    "signature_algorithm": "ECDSA-SHA256",
    "public_key": "ECDSA P-256",
    "sha256": "85CA6AB068E9BCCE88B6C4AA3C47F7D17228134A457F870D3800E6223A0DF07A",
    "is_ca": false,
    "self_signed": false,
    "ocsp": [
      "http://o.cf-i.ssl.com"
    ],
    "crl": [
      "http://c.cf-i.ssl.com/ae801ed1c55bb579d79208b0d772acfb8cc3a208.crl"
    ],
    "scts": 2
  },
  "ca": "SSL.com",
  "acme": true,
  "lifetime_days": 90,
  "age_days": 23,
  "days_left": 66,
  "client_auth_eku": false,
  "ari_error": "SSL.com offers ACME, but not through a public directory this checker can ask for renewal information",
  "edges": [
    {
      "addr": "104.20.23.154:443",
      "subject": "example.com",
      "issuer": "Cloudflare TLS Issuing ECC CA 3 (SSL Corporation)",
      "ca": "SSL.com",
      "not_before": "2026-09-26T22:49:11Z",
      "not_after": "2026-12-25T22:56:35Z",
      "days_left": 66,
      "sha256": "85CA6AB068E9BCCE88B6C4AA3C47F7D17228134A457F870D3800E6223A0DF07A",
      "primary": true
    },
    {
      "addr": "172.66.147.243:443",
      "subject": "example.com",
      "issuer": "Cloudflare TLS Issuing ECC CA 3 (SSL Corporation)",
      "ca": "SSL.com",
      "not_before": "2026-09-26T22:49:11Z",
      "not_after": "2026-12-25T22:56:35Z",
      "days_left": 66,
      "sha256": "85CA6AB068E9BCCE88B6C4AA3C47F7D17228134A457F870D3800E6223A0DF07A",
      "primary": true
    },
    {
      "addr": "[2606:4700:10::6814:179a]:443",
      "days_left": 0,
      "error": "not checked: this server has no IPv6 route",
      "skipped": true,
      "primary": false
    },
    {
      "addr": "[2606:4700:10::ac42:93f3]:443",
      "days_left": 0,
      "error": "not checked: this server has no IPv6 route",
      "skipped": true,
      "primary": false
    }
  ],
  "distinct": 1,
  "automation": "probably automated",
  "automation_evidence": "A 90-day certificate from SSL.com. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it.",
  "ready": "ready",
  "summary": "Ready for 47-day certificates: renewal looks automated",
  "schedule": [
    {
      "label": "15 March 2026 (in force)",
      "max_days": 200,
      "dcv_reuse_days": 200,
      "renewals_per_year": 3,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 3 renewals a year, none of them by hand.",
      "current": true
    },
    {
      "label": "15 March 2027",
      "max_days": 100,
      "dcv_reuse_days": 100,
      "renewals_per_year": 6,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 6 renewals a year, none of them by hand.",
      "current": false
    },
    {
      "label": "15 March 2029",
      "max_days": 47,
      "dcv_reuse_days": 10,
      "renewals_per_year": 12,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 12 renewals a year, none of them by hand.",
      "current": false
    }
  ],
  "findings": [
    {
      "status": "pass",
      "name": "Certificate lifetime",
      "value": "90 days",
      "note": "Already within the 100-day limit that applies from 15 March 2027."
    },
    {
      "status": "pass",
      "name": "Renewal automation",
      "value": "probably automated",
      "note": "A 90-day certificate from SSL.com. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it."
    },
    {
      "status": "pass",
      "name": "Renewal timing",
      "value": "66 of 90 days left",
      "note": "No renewal is due yet."
    },
    {
      "status": "info",
      "name": "ARI renewal window",
      "value": "not available",
      "note": "SSL.com offers ACME, but not through a public directory this checker can ask for renewal information. ARI is how a CA tells clients to renew early ahead of a revocation; without it, a mass revocation is a manual scramble.",
      "guide": "https://kirkdiamond.com/guides/acme-renewal-information-ari"
    },
    {
      "status": "pass",
      "name": "Edges",
      "value": "2 addresses, one certificate",
      "note": "Every address the name resolves to serves the same certificate, so the last renewal reached all of them."
    }
  ],
  "reproduce": "for ip in $(dig +short example.com A example.com AAAA); do echo \"$ip $(echo | openssl s_client -connect \"[$ip]:443\" -servername example.com 2\u003e/dev/null | openssl x509 -noout -enddate)\"; done"
}