HTTPS is the foundation. But is your TLS configuration truly secure?
Certificate¶
- ☐ Valid certificate (no self-signed in production)
- ☐ Automatic renewal (Let’s Encrypt + certbot)
- ☐ Certificate chain complete
- ☐ Wildcard or SAN for subdomains
Protocols¶
- ☐ TLS 1.2 minimum
- ☐ TLS 1.3 preferred
- ☐ SSL 2.0/3.0 and TLS 1.0/1.1 DISABLED
- ☐ Strong cipher suites
- ☐ Forward secrecy (ECDHE)
Headers¶
- ☐ HSTS (Strict-Transport-Security)
- ☐ HTTP → HTTPS redirect
- ☐ HSTS preload (optional)
- ☐ Expect-CT (deprecated, but still useful)
Testing¶
- ☐ SSL Labs test (A+ rating)
- ☐ Certificate expiry monitoring
- ☐ Mixed content check
- ☐ OCSP stapling working
Automation¶
Let’s Encrypt + certbot –renew = no expired certificates.
ssltlssecurity