SSL/TLS Certificate Check

Your SSL/TLS certificate is what turns the padlock on in the browser and encrypts everything between your visitors and your server. When it is misconfigured or expired, browsers throw full-page warnings that scare visitors away and tank conversions. VitalSite inspects your certificate on every scan using Node's native tls module — the same low-level checks a browser performs.

What VitalSite checks

• Validity and expiry. We read the certificate's expiry date and flag anything expiring within 30 days as a warning, and anything already expired as critical. Expired certificates break trust instantly.
• Trust chain. We confirm the certificate validates against trusted root authorities. A broken or incomplete chain causes "not trusted" errors on some devices even when it works in your browser.
• Protocol version. We record the negotiated TLS version. TLS 1.0 and TLS 1.1 are deprecated and insecure — VitalSite flags them as critical. You should require TLS 1.2 as a minimum and enable TLS 1.3.

Why it matters

An expired or untrusted certificate is one of the few issues that affects 100% of your visitors at once. Beyond the scare screen, weak protocols expose encrypted traffic to downgrade and interception attacks. Search engines also factor HTTPS health into rankings, so a lapse can cost you traffic as well as trust.

How to fix it

Renew before it lapses. Most hosts and CDNs (Cloudflare, Vercel, Netlify) auto-renew. If you manage your own server, automate renewal with certbot:

sudo certbot renew --quiet

Disable old protocols. On Nginx, restrict the protocols you accept:

ssl_protocols TLSv1.2 TLSv1.3;

On Apache, set SSLProtocol -all +TLSv1.2 +TLSv1.3. On managed platforms, this is handled for you — just confirm the dashboard shows TLS 1.2+ only.

Fix the chain. Make sure you install the full certificate chain (your certificate plus any intermediate certificates), not just the leaf certificate. Re-test afterward.

Once HTTPS is healthy, the natural next step is to enforce it everywhere and add HSTS so browsers refuse to connect over plain HTTP. See our SSL certificate guide for a deeper walkthrough of validity, expiry, and TLS versions.

Verify the fix

After renewing or changing protocols, re-scan your domain. The SSL/TLS check should flip to a green CLEAR result showing the issuer and days remaining, and the protocol line should read TLS 1.2 or 1.3.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.