An HTTPS connection depends on more than the presence of a padlock icon. The browser must trust the certificate, the certificate must match the hostname and the server must present a valid chain.
Certificate trust
A trusted certificate is signed by a certificate authority recognized by the browser or operating system. Self-signed certificates are useful in controlled environments but normally generate warnings on public websites.
Hostname matching
The requested hostname must appear in the certificate subject alternative names. A certificate for a different domain does not prove the identity of the requested website.
Validity period
Certificates have a start date and expiry date. Automated renewal reduces the risk of unexpected expiration, but renewal should still be monitored.
- More than 60 days remaining: normally healthy
- 31 to 60 days: begin monitoring renewal
- 15 to 30 days: renewal should be prioritized
- 14 days or fewer: urgent action is required
Certificate issuer and chain
The issuer identifies the certificate authority. The certificate chain links the website certificate through intermediate certificates to a trusted root.
An incomplete intermediate chain can create failures on some browsers, devices and automated clients even when the certificate itself is valid.
Public-key and signature details
A detailed report may also include the public-key algorithm, key size, signature algorithm, serial number and certificate fingerprint.
Recommended action
Use automated certificate renewal, monitor expiry, test the complete chain and redirect all HTTP traffic to HTTPS.