SSL & security header checker

• Valid to is the expiry date, and it is the field that causes outages. An expired certificate produces a full page browser warning, not a subtle one, so most visitors leave. If renewal is not automated, this date is a deadline.
• Common name and subject alternative names list every hostname the certificate covers. A certificate for example.com does not cover www.example.com unless that name is in the SAN list. This mismatch is the second most common certificate error after expiry.
• Issuer is the authority that signed it. Browsers trust the issuer, not you, so a self signed certificate will always warn no matter how correct everything else is.
• Protocol and cipher suite show what was actually negotiated. TLS 1.2 and 1.3 are current. TLS 1.0 and 1.1 are deprecated and will be refused by up to date clients.

A valid certificate encrypts the connection. The headers decide what the browser is allowed to do once it arrives, and most sites are missing several.

• Strict-Transport-Security tells browsers to use HTTPS for your domain from then on, which closes the gap where the first request goes out over plain HTTP. Start with a short max age, confirm nothing breaks, then raise it.
• Content-Security-Policy is the strongest control here and the most work to deploy. It limits which sources can execute script, which is what turns a cross site scripting bug from a compromise into a blocked request.
• X-Content-Type-Options set to nosniff stops the browser guessing a file type and executing an upload as script. One line, no downside.
• X-Frame-Options or a CSP frame-ancestors directive prevents your pages being framed by someone else, which is what clickjacking depends on.
• Referrer-Policy controls how much of the current URL is sent when a visitor follows a link away. It matters most where URLs carry tokens or identifiers.

• Certificate renewed but not reloaded. The new file is on disk and the server is still serving the old one from memory. Restart or reload the web server after renewal.
• www covered, bare domain not. Or the reverse. Both names need to be on the certificate.
• Incomplete chain. The certificate is valid but an intermediate is missing. Desktop browsers often paper over this while phones and command line tools fail, which makes it look intermittent.
• Mixed content. The page loads over HTTPS but pulls an image or script over HTTP, so the padlock disappears and the asset may be blocked outright.
• HSTS set too aggressively too early. A long max age is remembered by browsers and is difficult to undo if something on the site still needs HTTP.