SSL Certificate Checklist Before Launching a New Site

A pre-launch SSL checklist catches the issues that otherwise surface as live incidents in front of real visitors.

The checklist

  1. Certificate covers the exact domain and subdomains in use (including www if both are served)
  2. Full certificate chain is served, not just the leaf certificate (test from more than one device/browser)
  3. HTTP automatically redirects to HTTPS site-wide, with no mixed content warnings on any page
  4. Auto-renewal is configured and tested at least once before relying on it
  5. TLS 1.0/1.1 disabled; 1.2 and 1.3 enabled
  6. An independent uptime/SSL monitor is watching expiry, separate from whatever renews it

FAQ

Should I test the renewal process before go-live?

Yes — a dry-run or forced renewal test before launch is the cheapest way to catch a broken automation script before it matters.

Updated at: .