HTTPS certificate

This check leaves DNS behind and makes a real HTTPS request to the domain, follows the redirect chain, and reads the certificate presented at the end of it. It grades four things: whether anything answered, whether the certificate covers the name asked for, how long it has left, and whether the chain validates.

A name the certificate does not cover is a full-page browser interstitial for every visitor — not a subtle warning, a wall. It usually means the certificate was issued for the other form of the name: www.example.com and not example.com, or the reverse.

An invalid chain is the one that hides. Serving the leaf certificate without its intermediates works in most desktop browsers, because they have cached that intermediate from another site or will go and fetch it — so it looks fine on the machine you tested from and fails on mobile clients, in curl, in API clients and in anything with a fresh trust store. Reported as intermittent, it is completely deterministic.

Failing to connect at all is reported as unknown rather than as a fault. A firewall on their side and an outbound restriction on ours are indistinguishable from here, and only one of them is about the domain.

Automate issuance and renewal with ACME, and automate the reload as well. A certificate renewed on disk that the server never re-read expires exactly as loudly as one nobody renewed, and it is the more common version of this outage.

Put every name you actually serve in the certificate's subject alternative names — the apex and www at minimum, plus any other hostname terminating on the same listener.

Serve the full chain: leaf plus intermediates, and not the root. Then test it with something that has no cached intermediates, such as openssl s_client -showcerts -connect example.com:443, rather than the browser you have been using all day.

Once the certificate and the redirects are stable, HSTS is worth adding — but not before. It commits every returning visitor to HTTPS for the lifetime of the header, and a broken certificate after that has no click-through.