Why does an expired certificate keep happening?

Because renewal is tracked per certificate by whoever set it up, and the estate is not tracked at all. The certificates that expire are the ones on assets nobody has an inventory entry for, which is why discovery and TLS monitoring are the same problem.

Does a good grade mean the site is secure?

No. It means the transport is configured well. It says nothing about what the application does with the data once it arrives, which is the question AppSecD answers.

SSL/TLS certificate checker

A TLS certificate is the thing standing between a visitor and somebody reading their session. It is also the control that most often fails quietly: it does not break when it is weak, it breaks when it expires — usually on a host nobody remembered owning.

What this page checks

Validity and expiry — when the certificate expires and how many days remain. An expired certificate on a forgotten subdomain is one of the most common findings on any external estate.
Issuer and subject — who issued the certificate and which names it actually covers, including whether the host you asked about is one of them.
Chain completeness — a server that serves a leaf certificate without its intermediates works in one browser and fails in another.
Configuration grade — protocol versions and cipher configuration summarised into a grade, so a weak deployment is visible without reading an OpenSSL dump.

How it runs

This page performs a live lookup against the domain you enter and returns the result in the browser. Nothing is installed and no credential is needed.

Where this sits in Maphra

Maphra does not check one host you thought of — it checks every host it discovers, on a schedule, and diffs the result against the last known surface. TLS and certificate posture is one of the five things it examines on every asset, alongside security headers, DNS hygiene, email authentication and misconfiguration checks, and every finding carries the raw response that produced it. Certificate transparency monitoring also runs in the other direction: a certificate issued for a name you own is itself a discovery signal.

Questions

Why does an expired certificate keep happening?: Because renewal is tracked per certificate by whoever set it up, and the estate is not tracked at all. The certificates that expire are the ones on assets nobody has an inventory entry for, which is why discovery and TLS monitoring are the same problem.
Does a good grade mean the site is secure?: No. It means the transport is configured well. It says nothing about what the application does with the data once it arrives, which is the question AppSecD answers.

A one-off check tells you about one asset today. Maphra runs this continuously across everything it discovers, and a walkthrough uses your own domain rather than a sample.