SSL Certificate Guide: Validity, Expiry, and TLS Versions

An SSL/TLS certificate does two jobs: it encrypts traffic between the browser and your server, and it proves your site is genuinely yours. A misconfigured or expired certificate breaks both — and browsers show a full-page warning that scares away visitors.

Expiry

Certificates are short-lived (often 90 days with Let's Encrypt). VitalSite flags any certificate expiring within 30 days so you can renew before it lapses. Automate renewal with certbot or your host's auto-renew.

The certificate chain

Browsers trust your certificate only if it links back to a trusted root through valid intermediate certificates. A missing intermediate is the most common cause of "works in Chrome but not on mobile" errors. Always install the full chain (fullchain.pem).

TLS versions

TLS is the protocol that does the encryption. Old versions are broken:

• TLS 1.0 / 1.1 — deprecated and insecure. VitalSite flags these as critical. Disable them.
• TLS 1.2 — the safe minimum.
• TLS 1.3 — fastest and most secure; enable it.

On Nginx:

ssl_protocols TLSv1.2 TLSv1.3;

Verify

Run a VitalSite scan or test at ssllabs.com. Aim for an A grade with TLS 1.2+ only.