Is my website’s SSL certificate valid? How to check and fix it

Last reviewed

The padlock in the address bar means your site has a valid security certificate and the connection is encrypted. When the certificate is missing, expired or misconfigured, browsers show a warning and most visitors leave.

There are three things to get right: a certificate browsers trust, automatic renewal, and a redirect so nobody lands on the unencrypted version of your site.

Check your own site for this in about a minute

Your security certificate is missing or not trusted

What it is. Browsers can’t confirm your site is really yours, so visitors see a warning or no padlock.

Why it matters. Visitors leave, and anything typed into the site can be read or changed on the way.

Time to fix. About 15 minutes

Nginx

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Apache / cPanel

sudo apt install certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com

Cloudflare

SSL/TLS > Overview > set encryption mode to "Full (strict)"
SSL/TLS > Edge Certificates > confirm "Universal SSL" is active

Any host

Turn on a free Let’s Encrypt certificate in your hosting control panel (often called "SSL" or "AutoSSL"),
then reload your site and check the padlock.

Your security certificate expires soon

What it is. Your certificate runs out in less than three weeks.

Why it matters. When it expires, browsers block visitors with a full-page warning.

Time to fix. About 10 minutes

Nginx

sudo certbot renew --dry-run
# then make sure the certbot timer is enabled:
sudo systemctl enable --now certbot.timer

Apache / cPanel

sudo certbot renew --dry-run
sudo systemctl enable --now certbot.timer

Cloudflare

SSL/TLS > Edge Certificates: Universal SSL renews automatically.
Check the origin certificate on your server too.

Any host

Renew the certificate in your hosting panel, and switch on automatic renewal so this never comes back.

Visitors can still reach the unencrypted version of your site

What it is. Typing your address without https:// loads the site without encryption.

Why it matters. Anyone on the same Wi-Fi can read or tamper with that traffic.

Time to fix. About 5 minutes

Nginx

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Apache / cPanel

# .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Cloudflare

SSL/TLS > Edge Certificates > Always Use HTTPS: On

Any host

Turn on "Force HTTPS" or "HTTPS redirect" in your hosting panel.

Your certificate uses a weak encryption key

What it is. The key behind your certificate is shorter than today’s minimum (2048-bit RSA or 256-bit EC).

Why it matters. Short keys are within reach of well-funded attackers and are being rejected by browsers.

Time to fix. About 15 minutes

Nginx

sudo certbot renew --force-renewal --key-type ecdsa
sudo nginx -s reload

Apache / cPanel

sudo certbot renew --force-renewal --key-type ecdsa
sudo systemctl reload apache2

Cloudflare

SSL/TLS > Edge Certificates: Cloudflare certificates use strong keys.
Also check the origin certificate on your own server.

Any host

Reissue your certificate with a 2048-bit (or larger) RSA key or an ECDSA P-256 key. Most hosts do this when you renew.

Any certificate company may issue certificates for your domain

What it is. Your domain has no CAA record listing which certificate authorities you use.

Why it matters. A CAA record makes it harder for someone to trick a certificate company into issuing a certificate for your site.

Time to fix. About 5 minutes

Cloudflare

DNS > Add record > Type CAA > Name @ > Tag "Only allow specific hostnames" > Value letsencrypt.org
(Cloudflare adds its own CAs automatically when it manages your certificate.)

Any host

Add a DNS record for each certificate company you use, for example:
Type: CAA   Name: @   Value: 0 issue "letsencrypt.org"