Is your website's certificate in order?
Enter a domain to see whether its website serves HTTPS, which certificate it presents, when that certificate expires, and whether plain HTTP is sent on to HTTPS.
Last reviewed
The check connects the way a browser does.
It opens one TLS connection to the website on port 443, reads the certificate and the protocol version, and asks for the home page over plain HTTP to see whether it redirects to HTTPS. People still say SSL certificate; the protocol has been TLS for years, and the check reports both the certificate and the TLS version.
What it can find.
| What the check finds | Finding | Severity |
|---|---|---|
| No HTTPS; the site answers only over HTTP | No HTTPS: website served without encryption | Critical95 |
| No HTTPS on this name, but HTTP redirects to HTTPS elsewhere | Apex does not serve HTTPS directly | Medium45 |
| Port 443 answers, but the TLS handshake fails | TLS handshake failed | High70 |
| Nothing answers on HTTPS or HTTP | HTTPS not available | High80 |
| The certificate has expired | SSL certificate expired | High75 |
| The certificate is self-signed | Self-Signed certificate | High70 |
| TLS 1.0 or 1.1 is negotiated | Weak TLS version | Medium65 |
| The certificate expires within 30 days | SSL certificate expiring soon | High75 |
| The negotiated cipher is weak | Weak cipher suites detected | High70 |
| HTTP is not redirected to HTTPS | HTTP not redirecting to HTTPS | Medium55 |
Automate renewal, then redirect.
Most certificate findings come from manual renewal. A certificate from an ACME authority such as Let's Encrypt renews itself every few weeks, which removes both the expired and the expiring-soon findings. Once HTTPS works, redirect all HTTP traffic to it permanently and add an HSTS header. The TLS certificate checklist covers renewal, chains and monitoring step by step.
One handshake, the version it negotiates.
- One connection. The check records the TLS version and cipher the server and client agree on, not every version the server would accept. A server that also accepts TLS 1.0 for older clients is not flagged if it negotiates TLS 1.3 here, and a server that speaks only TLS 1.0 or 1.1 fails the handshake, so it shows as a failed handshake rather than a weak version. The full scan behaves the same way.
- The name you enter.
wwwand other subdomains can present other certificates. - No chain or name validation. The check reads the certificate's dates, issuer and subject; it does not test the full chain of trust or every name on the certificate.
The certificate is one part of the TLS and web security module, next to the security headers. The free check covers all six modules.