Security certificate

What we check

We set up an encrypted connection to the website's server and read out the security certificate:

• Is it valid? An expired, self-issued certificate or one issued for another domain name is a serious defect.
• Does it expire soon? With less than 14 days of remaining validity we warn.
• Which TLS version does the server use? TLS 1.0 and 1.1 are considered outdated and are a serious defect: current browsers no longer connect with them.

In the report you see until when the certificate is valid and which TLS version was used.

Why it matters

The certificate is the ID of the website. It confirms to the browser that it is really talking to the right server and not to a fraudster in between.

If the certificate is invalid or expired, the browser shows a full-page warning such as "Your connection is not private". Almost all visitors give up at this point, and anyone who clicks on regardless has little trust afterwards. For Google the page is practically unreachable in this state.

Expired certificates are the most common cause of such warnings. They usually arise because the automatic renewal no longer works, for example after the DNS records were moved, or because a purchased certificate would have to be renewed by hand every year and nobody has it in the calendar.

How to fix it

Invalid or expired certificate

1. Log in to the hosting provider and check the status of the certificate in the domain administration.
2. Issue it again, usually with one click at "SSL" or "Let's Encrypt".
3. If the certificate covers only example.ch but not www.example.ch, include both names.

Ensure automatic renewal

Let's Encrypt renews certificates automatically, but only if the domain still points to the server that requests the certificate. If the DNS records have been changed, for example for a new email provider or a CDN, check the renewal. For purchased certificates, enter the expiry date in the calendar and have yourself reminded four weeks beforehand.

Outdated TLS versions

Ask the hosting provider to switch off TLS 1.0 and 1.1 and to allow only TLS 1.2 and 1.3. On a dedicated server with Apache the setting is SSLProtocol -all +TLSv1.2 +TLSv1.3, with nginx ssl_protocols TLSv1.2 TLSv1.3;.

How to check it yourself

In the browser click the icon to the left of the address and then the details about the connection or the certificate. There you see who issued the certificate and until when it is valid. The free test by SSL Labs (ssllabs.com/ssltest) also shows all supported TLS versions.

Frequently asked questions

Why does a certificate expire after only three months?

Certificates from Let's Encrypt are deliberately valid for only a few weeks to months and are renewed automatically. This is safer than long validity periods. It only becomes a problem if the automatic renewal does not work.

What does "TLS 1.0" or "TLS 1.1" mean?

These are outdated versions of the encryption protocol with known weaknesses. Current browsers refuse them. The server should use TLS 1.2 and TLS 1.3.