SSL Hygiene Beyond the Padlock: A Certificate Audit Checklist for Small Teams
Most site owners think about SSL in one way: is the padlock showing? That check is useful but shallow. A certificate can be valid today and still leave visitors exposed to broken pages, warning prompts, or a slow fallback to insecure content. Good SSL hygiene means looking at the whole path a request takes, from the certificate itself through the server configuration, redirects, and the resources each page loads. This article offers a method you can apply to any hosting setup, along with the questions to ask your provider and your team before you need an emergency fix.
Start With a Hostname Inventory
Before you can audit certificates, you need to know which hostnames exist. Small sites accumulate them over time: the apex domain, the www version, a blog subdomain, a staging copy, a payment or form endpoint, and perhaps an old marketing page that still receives traffic from search results. Write each one down in a simple table with columns for purpose, who requested it, where it is hosted, and whether it is currently in use.
This inventory is the foundation of every later step. A certificate that covers the main domain but not a forgotten subdomain will fail quietly, often on a page nobody checks until a visitor complains. Include redirect-only hostnames too, because a redirect that points at a broken HTTPS endpoint is still a failure.
Verify the Full Certificate Chain
An expiry date is only one attribute. The certificate must also chain correctly to a trusted root through any intermediate certificates the server should present. A missing intermediate is a common cause of errors that appear on some devices and not others, which makes it easy to miss during casual testing on a single laptop.
Test from more than one client. Use an online chain checker or your command-line tools to confirm that the server sends the complete chain, and that the leaf certificate's names match the hostnames in your inventory. Note the issuing authority and the validity window for each certificate, and record them alongside the hostname.
Audit Redirects as Carefully as Certificates
Redirect chains are one of the most overlooked sources of SSL trouble. A visitor who types your domain without a scheme may pass through an HTTP address, then an HTTPS address on a different hostname, then a final page. Each hop adds delay and another opportunity to land on a misconfigured endpoint.
Check that every HTTP request leads to its HTTPS equivalent in a single hop where possible, and that the destination uses the canonical hostname you chose. Look for loops, for redirects that drop the path or query string, and for legacy rules that still point at an address you have retired. Write down the intended final destination for each entry point so that future changes can be compared against it.
Look for Mixed Content
A page can load over HTTPS while still requesting images, scripts, stylesheets, or embedded frames over plain HTTP. Browsers may block some of these resources or display warnings that undermine visitor trust. Mixed content often appears after a site migration, after a theme or plugin is updated, or when content editors paste links copied from older posts.
To audit it, load each important template in a browser with developer tools open and review the console and network panels. Pay special attention to pages that include third-party widgets, embedded media, and checkout or login forms. Hardcoded absolute URLs in your database are a frequent culprit, so search your content store for the insecure prefix as part of the review.
Know Who Holds the Keys
Hygiene also includes governance. For each certificate, record who can request renewals, where the private key is stored, who receives expiry notices, and what happens if the person responsible leaves the team. These are questions to put to your hosting provider and your internal team. Ask whether the certificate is managed for you or uploaded by you, how renewals are triggered, and what steps are needed to replace one manually.
Do not assume answers. Confirm them in writing, and store the answers in the same place as your inventory so that they survive staff changes.
A Practical Audit Checklist
Run through these items on a regular schedule, such as once per quarter or before any major change. Confirm that every hostname in your inventory has a certificate that covers it and has a documented expiry date. Verify that each chain is complete from at least two client environments. Check that every HTTP entry point reaches the canonical HTTPS address in one hop. Load key pages and confirm there are no mixed-content warnings. Confirm that the certificate owner, renewal path, and notification recipients are recorded and current.
When a check fails, log the finding with a date, an owner, and a target fix date. A short written record is more useful over time than a memory of what went wrong last year. SSL hygiene is less about heroic fixes and more about small, repeated checks that catch drift before it reaches visitors.