Free check

HTTPS and SSL certificate check

An expired or untrusted certificate puts a full-page warning in front of every visitor. A missing redirect leaves people on unencrypted HTTP. This check covers both, plus certificate authorities that browsers have recently stopped trusting.

Why it matters

Certificates expire, renewals fail silently, and authorities occasionally get distrusted, as happened to several emSign intermediates in October 2026. Any of these takes your site down for visitors until it's fixed.

What this check looks at

Whether the certificate is trusted and when it expires (we warn 14 days ahead)
Whether http:// redirects straight to https://
The negotiated TLS version (1.0 and 1.1 are flagged)
Certificate chains through authorities named in recent incidents

How to fix it

Free certificate with automatic renewal

# On a server with Nginx (Let's Encrypt via certbot)
sudo certbot --nginx -d example.com -d www.example.com

# Check renewal works
sudo certbot renew --dry-run

Redirect HTTP to HTTPS (Nginx)

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Redirect HTTP to HTTPS (Apache)

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Managed hosts

Vercel, Netlify, Cloudflare Pages and most managed hosts issue and renew certificates
automatically. If yours shows a problem, check the domain's DNS points at the host and
that the domain is verified in the dashboard.

Questions

How early should I renew?

Automate renewal so you never have to think about it. Let's Encrypt certificates last 90 days and certbot renews them at around 60.

Do I need HSTS once I redirect to HTTPS?

Yes. The redirect still lets a visitor's first request go over HTTP; HSTS tells browsers to use HTTPS from the start next time. The security headers check covers it.