This check reads public Certificate Transparency logs. It never connects to the domain, so it shows what has been issued for the name, not what the server is sending right now.

• Logs show certificates issued for the name, not necessarily the one being served.
• CDN-managed certificates renew on the CDN's schedule, so the pattern shows the CDN's process, not yours.
• Internal hosts that are not in public logs cannot be checked.
• Logs can take a few minutes to show a new certificate.