← All checks

HTTPS certificate and HSTS check: expired, name mismatch, TLS version

HTTPS medium Web · 7 of 100 points

What it inspects

A TLS handshake with the domain and with www.<domain> on port 443, then, if the certificate verifies, one request for / to read headers. The apex is judged if it verifies, else www. Verdicts: PASS for a valid certificate with at least 14 days left, TLS 1.2 or newer and an HSTS header. WARN for a certificate expiring within 14 days, TLS below 1.2, no HSTS header, or no HTTPS service reachable on either name. FAIL when the judged certificate is expired, does not match the name or is not trusted. Not applicable if neither name has an A or AAAA record.

Why it matters

An expired or mismatched certificate shows every visitor a browser warning. HSTS stops browsers connecting over plain HTTP at all, which blocks downgrade attacks.

How to verify by hand

# bash
dig +short A example.com

# PowerShell
Resolve-DnsName -Name example.com -Type A

# bash: certificate dates and the HSTS header (needs openssl and curl)
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -dates
curl -sI https://example.com | grep -i strict-transport-security

# PowerShell: the HSTS header
(Invoke-WebRequest https://example.com -Method Head).Headers['Strict-Transport-Security']

How to fix

Install a certificate from a public CA that covers the name, automate renewal, and send an HSTS header.

  1. Get a certificate that lists both example.com and www.example.com, and automate renewal (ACME).

  2. Disable TLS 1.0 and 1.1 on the web server.

  3. Send HSTS once HTTPS works everywhere:

    Strict-Transport-Security: max-age=31536000; includeSubDomains

    Add includeSubDomains only if every subdomain serves HTTPS.

References

Scan your domain free