HTTPS relies on TLS to encrypt exchanges and allow the browser to verify the technical identity of the server. A correct configuration protects the connection against eavesdropping and tampering in transit, but it does not automatically make the site trustworthy.
What TLS protects
When connecting, the server presents a certificate containing the domain names it covers and a validity period. The browser checks the chain of trust, then negotiates session keys to encrypt exchanges.
- the data circulates encrypted between the browser and the server;
- a change in transit is detected;
- the server proves that it uses a valid certificate for the name requested.
This protection applies to the network connection. The data can then be stored or processed by the application according to its own rules.
What the lock doesn't guarantee
A phishing site can also obtain a certificate for its own domain. TLS does not verify that the commercial offer is honest, that the site code is free of vulnerabilities or that the database is well protected.
The certificate therefore does not replace updates, access management, backups, logs and application controls.
Points to be checked on a certificate
| Monitoring | Why? |
|---|---|
| Expiration date | An expired certificate triggers a blocking alert |
| Names covered | The requested domain name must be included in the certificate |
| Chain | Intermediate certificates must be properly served |
| Algorithms and protocols | Obsolete versions must be disabled |
| Redirections | All public URL variants must redirect to HTTPS |
Why automatic renewal can fail
Short-term certificates are designed to be automatically renewed. However, automation may fail if the DNS has changed, the validation port is blocked, the server is not responding, permissions have been changed or the planned task is not working.
Check that the renewal is actually tested and not just configured. After each proxy, DNS or hosting change, check the validation path again.
Monitor before expiry
A useful alert must leave enough time to correct the problem. Check the expiry date at several deadlines, for example well before expiry and more frequently as the date approaches. Also watch the certificate actually presented from the Internet: a file renewed but not reloaded by the server does not resolve the incident.
- test automatic renewal;
- control all domain variants;
- verify the certificate after deployment;
- provide an alert to an address still consulted;
- document the manual renewal procedure.
Check the HTTPS of a domain
DomainCheck controls the publicly submitted certificate, its validity and several parameters related to the domain.
Check my HTTPS configurationWhat to do with a certificate alert?
Do not advise visitors to bypass the alert. Check the requested name, certificate presented, date and chain. Renew or fix the configuration, reload the server, and then test from an external network.
To automate this follow-up, see Monitor a domain, its TLS certificate and DMARC.
To determine the order of intervention when a check fails, see also how to prioritize a domain alert.
Published on 5 August 2026.