SSL checker. Is the padlock right?
Type a domain. We connect to it on port 443 as a browser would and tell you, in plain words, whether its certificate can be trusted.
Renew before the end
Most certificates last 90 days or less now. On Tanzahost, they renew by themselves, 30 days before the end.
Send the whole chain
A server must send its certificate and the ones in between. Phones are stricter than laptops about it.
Cover every name
duka.co.tz and www.duka.co.tz are two names. The certificate must list each one your visitors use.