{"id":22925,"date":"2026-08-30T09:43:46","date_gmt":"2026-08-30T07:43:46","guid":{"rendered":"https:\/\/www.curiaweb.ch\/?post_type=docs&#038;p=22925"},"modified":"2026-08-30T09:43:47","modified_gmt":"2026-08-30T07:43:47","password":"","slug":"check-ssl-https","status":"publish","type":"docs","link":"https:\/\/www.curiaweb.ch\/en\/hilfe\/seo-monitoring\/ssl-https-pruefen\/","title":{"rendered":"Check SSL Certificate and HTTPS: Identify Common Errors"},"content":{"rendered":"<p class=\"wp-block-paragraph\">HTTPS is now standard for a professional website. It encrypts the connection between the browser and the web server and protects transmitted data from being read or modified unnoticed during transit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That a website fundamentally via <code>https:\/\/<\/code> being accessible, however, does not automatically mean that the entire HTTPS configuration is error-free.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An expired certificate, an incorrect hostname, mixed content, faulty redirects, or issues with the certificate chain can cause browsers to display security warnings or fail to load individual resources correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we show you how to systematically investigate SSL\/TLS and HTTPS problems and distinguish typical errors from each other.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Briefly explained:<\/strong> SSL certificates enable an encrypted HTTPS connection and confirm for which domain or hostname a certificate is valid. Therefore, when the browser displays an HTTPS warning, you should not only check whether a certificate is present at all, but also its validity, hostname, certificate chain, and the resources loaded by the website.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">SSL and TLS: Which one is actually correct?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In everyday life, people still often speak of a <strong>SSL certificate<\/strong> Spoken.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technically, however, modern HTTPS connections use TLS. SSL refers to older predecessor protocols.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Terms such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SSL certificate\nSSL encryption\nSSL for website<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">nevertheless remain common in general usage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, technically more precise would be:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>TLS certificate\n\nor\n\nHTTPS connection with TLS<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we use the common term SSL certificate where it facilitates understanding.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What does HTTPS do?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">During an HTTPS connection, the browser communicates with the server in an encrypted manner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simplified:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Browser\n   \u2193\nTLS connection\n   \u2193\nVerify identity \/ certificate\n   \u2193\nEncrypted connection\n   \u2193\nWeb server<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is intended in particular to protect the confidentiality and integrity of the transmitted data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTP and HTTPS are different URL variants<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These two URLs look similar:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>http:\/\/example.com\/<\/code><\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/example.com\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Technically, however, these are different URL variants.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On a website that has been completely switched to HTTPS, the HTTP version should normally redirect cleanly to the corresponding HTTPS version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:\/\/example.com\/beispiel\/\n\n        \u2193\n\n301 Permanent Redirect\n\n        \u2193\n\nhttps:\/\/example.com\/beispiel\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We explain how permanent redirects work at <a href=\"\/en\/help\/seo-monitoring\/301-weiterleitung-einrichten\/\">Set up a 301 redirect: Permanently redirect URLs<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is an SSL certificate?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A certificate contains information needed for establishing and testing a secure connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This includes, among other things, information on which hostnames the certificate is valid for, who issued it, and the period for which it is valid.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A browser checks this information when establishing the HTTPS connection.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What information should you check on a certificate?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When troubleshooting, the following points are particularly relevant:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Domain \/ Hostname\n\nIssuer\n\nValid From\n\nValid To\n\nSubject Alternative Names\n\nCertificate Chain\n\nTrustworthiness<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Modern browsers provide some of this information via the security or certificate information or the developer tools.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The padlock symbol is not the whole diagnosis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Browser interfaces change regularly. Depending on the browser and version, a secure connection is therefore not always displayed with the exact same icon.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not rely solely on a lock icon for technical diagnostics.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More important is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Is https:\/\/ used?\n\nIs the certificate valid?\n\nDoes it match the hostname?\n\nIs the connection trusted?\n\nAre insecure resources loaded?<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">First test: Access website directly via HTTPS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start with the actual HTTPS address:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/deine-domain.ch\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">First, check if the page opens without a security warning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Afterwards, you should not only test the home page, but also some typical subpages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Home page\n\nSubpage\n\nBlog post\n\nContact page\n\nShop or product page<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A problem can affect only individual pages or resources.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Second test: Call HTTP version<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Then, consciously open the unencrypted version:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>http:\/\/deine-domain.ch\/<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On a website that has been completely switched to HTTPS, this should normally become the corresponding HTTPS address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also check a subpage:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>http:\/\/deine-domain.ch\/beispiel\/<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">She should not be sent to the home page across the board, but normally to:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/deine-domain.ch\/beispiel\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">also check www and non-www<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, variants with and without frequently exist <code>www<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:\/\/example.com\/\n\nhttps:\/\/www.example.com\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If only one of these variants is used as the primary website, the other should consistently redirect to it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same applies to HTTP variants.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A typical configuration can look like this, for example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:\/\/example.com\/\n        \u2193\nhttps:\/\/www.example.com\/\n\nhttp:\/\/www.example.com\/\n        \u2193\nhttps:\/\/www.example.com\/\n\nhttps:\/\/example.com\/\n        \u2193\nhttps:\/\/www.example.com\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Which variant is used as the primary address is less important than a consistent technical implementation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 1: Certificate has expired<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Certificates have a limited period of validity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a certificate is not renewed in time, the browser may display a security warning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, you should check the validity dates during the diagnosis:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>valid from:\n...\n\nvalid until:\n...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the current date is outside the validity period, the certificate must be renewed or the automatic renewal must be checked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why certificates are renewed automatically<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Modern hosting systems frequently automate the issuance and renewal of certificates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, automatic renewal can fail if, for example, the domain no longer points correctly to the server or a necessary validation cannot be performed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, when a certificate has expired, not only should the certificate be replaced manually, but the cause of the failed renewal should also be investigated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 2: Certificate is not yet valid<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Even a certificate with a validity start date in the future can cause a warning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the event of such errors, it should additionally be checked whether the date and time on the affected device or system are set correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An incorrect local clock can cause a certificate that is actually valid to appear from the device's perspective as not yet valid or already expired.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 3: Certificate does not match the domain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A certificate must be valid for the requested hostname.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose you call:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/shop.example.com\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">However, the delivered certificate only covers:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>www.example.com<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ab.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then there is a hostname mismatch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The browser cannot verify that the certificate was issued for the hostname actually accessed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check Subject Alternative Names<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Modern certificates can be valid for multiple hostnames.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These are typically specified via so-called Subject Alternative Names \u2013 or SAN for short.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a certificate could cover the following names:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>example.com\n\nwww.example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Another subdomain like:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>shop.example.com<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">is not automatically included as a result.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Wildcard certificates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A wildcard certificate can cover multiple subdomains of a specific level.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>*.example.com<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">can for hostnames like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>shop.example.com\n\nmail.example.com\n\nportal.example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">be used.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The main domain:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>example.com<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">however, is not automatically covered by the wildcard name itself. It may need to be included in the certificate additionally.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 4: Incomplete certificate chain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Browsers do not trust a server certificate in isolation. Intermediate certificates can exist between the website's certificate and a trusted root certificate authority.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simplified:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Website Certificate\n        \u2193\nIntermediate CA\n        \u2193\nRoot CA<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The server must correctly provide the required certificate chain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a necessary intermediate certificate is missing, individual clients may experience issues with trust verification.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why does a broken certificate chain sometimes still work?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An already used browser or a specific operating system may already know required intermediate certificates under certain circumstances.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This can cause an incorrect server configuration to appear to work on one device while another device displays a certificate warning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If HTTPS issues only occur on certain devices, the certificate chain should therefore also be investigated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 5: Mixed Content<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Mixed content occurs when an HTTPS page loads resources over unencrypted HTTP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, the actual page is accessed via:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/example.com\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">however, there is a resource in the HTML such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;img src=&quot;http:\/\/example.com\/bild.jpg&quot;&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script src=\"http:\/\/example.com\/script.js\"&gt;&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The page itself uses HTTPS, but individual components are requested via HTTP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why mixed content is problematic<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS is intended to establish a secure connection for the delivered content.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If components are loaded via HTTP, this security assumption is not fully met for these resources.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Browsers can therefore block such requests, update them automatically, or issue warnings\u2014depending on the resource type and browser.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Typical causes of mixed content<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After switching from HTTP to HTTPS, old absolute URLs often remain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTML content\n\nCSS files\n\ntheme settings\n\nWordPress database\n\nwidgets\n\npage builders\n\nJavaScript\n\nexternal resources\n\nold image URLs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Especially on older websites, such URLs can be stored in many places.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Find Mixed Content with Browser Developer Tools<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The developer tools of modern browsers are particularly helpful for this diagnosis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open the affected page and check in particular the console and the network tab.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the case of mixed content, you will often find references there to the affected resource.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Search for URLs starting with:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>http:\/\/<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">begin, although the page itself via:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>https:\/\/<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">was loaded.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Practical Tip:<\/strong> Fix the actual HTTP reference. Simply ignoring a browser warning or disabling security mechanisms locally does not solve the problem for your visitors.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Mixed Content in WordPress<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In WordPress, mixed content occurs particularly often after changing the domain, migrating a website, or a previous HTTP configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, check whether the WordPress and website addresses are correctly set to HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:\/\/example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Old HTTP addresses may also be stored directly in content, widgets, theme options, or database fields.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not just blindly perform Search &amp; Replace<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A blanket search and replace directly in a WordPress database can be problematic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress, themes, and plugins can store structured or serialized data. Improper replacement can corrupt this data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, use appropriate WordPress tools and create a backup before making extensive changes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 6: Redirect loop after switching to HTTPS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A faulty HTTPS configuration can create a redirect loop.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\n \u2193\nHTTPS\n \u2193\nHTTP\n \u2193\nHTTPS\n \u2193\n...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The browser stops the redirection after a certain number of steps and reports an error.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The cause can be in various places:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Web server configuration\n\n.htaccess\n\nWordPress\n\nPlugin\n\nReverse Proxy\n\nCDN\n\nLoad Balancer<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Avoid multiple HTTPS redirects simultaneously<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Problems often arise when multiple layers independently attempt to enforce HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>CDN forces HTTPS\n\nWeb server forces HTTPS\n\nWordPress plugin forces HTTPS\n\nadditional .htaccess rule forces HTTPS<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This does not necessarily cause an error, but it makes the configuration unnecessarily complex and makes diagnosis more difficult.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS should be implemented cleanly and traceably at an appropriate location.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 7: Too many redirects<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Even without an infinite loop, an unnecessarily long redirect chain can occur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:\/\/example.com\/\n \u2193\nhttp:\/\/www.example.com\/\n \u2193\nhttps:\/\/www.example.com\/\n \u2193\nhttps:\/\/www.example.com\/de\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If technically feasible, unnecessary intermediate steps should be avoided.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A clean configuration redirects an old variant as directly as possible to the final target URL.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 8: HTTPS only works with or without www<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/example.com\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">works, but:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.example.com\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">generates a certificate warning, it should be checked:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Does the DNS record exist?\n\nDoes it point to the correct infrastructure?\n\nIs the hostname included in the certificate?\n\nIs the web server configured for this host?\n\nIs the redirection correct?<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A certificate can only be provided meaningfully for a hostname if the entire domain and server configuration matches it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">DNS and SSL are related during issuance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In many automated certificate procedures, it must be proven that the domain or hostname is controlled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the domain points to an incorrect infrastructure, automatic issuance or renewal can therefore fail.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In case of problems, you should check the DNS resolution. We explain how this works at <a href=\"\/en\/help\/domains-dns\/dns-eintraege-pruefen\/\">Check DNS records<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not confuse DNS change and certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After a server change, two separate processes may be involved:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\n\u2192 Visitors must reach the\n  correct server\n\nTLS\n\u2192 This server must deliver a\n  valid certificate<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A correct certificate on the new server does not help if a visitor still reaches a different server due to their DNS resolution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Conversely, the domain may already arrive at the new server while a suitable certificate has not yet been installed there.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 9: Incorrect certificate is being served<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A server can manage multiple websites and certificates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the event of an incorrect virtual host configuration, a certificate from another website may occasionally be served for a domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can recognize this by the fact that the requested hostname does not match the names in the issued certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, it is not the browser that needs to be repaired, but the certificate or web server configuration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error 10: Certificate renewed, browser still shows old certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If a certificate has been renewed but the old certificate continues to be served, there can be various causes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Web server is still using old certificate file\n\nService was not reloaded correctly after change\n\nReverse proxy is serving a different certificate\n\nCDN terminates TLS\n\nDNS points to a different server<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, what is crucial is not only which certificate is stored somewhere on the server, but which certificate is actually delivered when establishing a connection.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">consider CDN and reverse proxy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When using a CDN or reverse proxy, the TLS connection can take place at multiple points.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simplified:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Visitor\n   \u2193 HTTPS\nCDN \/ Proxy\n   \u2193 HTTPS\nOrigin Server<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This allows different certificates to be involved as well.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A valid certificate on the origin server therefore does not automatically mean that the publicly delivered certificate is correct \u2013 and vice versa.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check HTTPS in browser<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can use the browser for an initial diagnosis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Requested URL\nSecurity status\nCertificate information\nHostname\nValidity period\nIssuer\nConsole\nNetwork requests<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In the event of an error, you should document the exact message instead of merely noting \u201eSSL is not working.\u201c.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The exact error message is crucial<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There is a big difference between the following situations:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Certificate expired\n\nHostname incorrect\n\nInvalid certificate chain\n\nMixed content\n\nRedirect loop\n\nDNS points incorrectly\n\nServer unreachable<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">From a user's perspective, they can all initially look like an \u201eHTTPS problem,\u201c but they require completely different solutions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check HTTP status code additionally<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS and HTTP status codes are different layers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A TLS connection can be established successfully and the website can still respond with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>404 Not Found\n\n500 Internal Server Error\n\n503 Service Unavailable<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then the encrypted connection is working, while the application or the requested content has a different issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We explain the most important status codes at <a href=\"\/en\/help\/seo-monitoring\/http-status-codes-explained\/\">HTTP status codes explained: 200, 301, 404, 403, and 500<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">An HTTP 500 error is not an SSL error<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the browser successfully establishes an HTTPS connection and the server then responds with <code>500 Internal Server Error<\/code> replies, TLS has already successfully done its part.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The cause then typically lies at a later stage.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\n \u2193\nTLS successful\n \u2193\nHTTP request\n \u2193\nApplication\n \u2193\n500 Internal Server Error<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Keeping these layers cleanly separated saves a lot of time when troubleshooting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A DNS error is also not automatically an SSL error<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the domain name cannot be resolved at all, the browser may not yet reach a server with which it could establish a TLS connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Even if the website does not appear in the browser, it is initially a DNS or accessibility issue.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS and website monitoring<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An external HTTPS monitor can regularly check whether a secure connection to the website can be established and an expected response can be received.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the monitoring system, certificate issues or an impending expiration date can also be monitored.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We explain how such tests generally work at <a href=\"\/en\/help\/seo-monitoring\/website-monitoring-availability\/\">Website Monitoring: Monitor Availability and Outages<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why certificate monitoring makes sense<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Automatic certificate renewal significantly reduces administrative overhead. Nevertheless, a renewal can fail due to a technical glitch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An additional external check can therefore help to detect an unexpectedly upcoming expiration date in good time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monitoring does not, however, replace fixing the cause if the automatic renewal is actually malfunctioning.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS and Google<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For search engines, the signals of an HTTPS website should be consistent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If HTTPS is the preferred variant, among other things:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Internal links\n\nRedirects\n\nCanonical URLs\n\nXML sitemap\n\nPublic website URLs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">consistently point to the HTTPS version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The XML sitemap should contain the desired HTTPS URLs accordingly. You can find out more at <a href=\"\/en\/help\/seo-monitoring\/submit-xml-sitemap-to-google\/\">XML Sitemap: What it does and how to submit it to Google<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not point canonical to HTTP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When the website has been completely switched to HTTPS, an HTTPS page should normally not simultaneously designate an HTTP version as the preferred URL via its canonical element.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Such a configuration produces contradictory technical signals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Simplified, the image should look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\n \u2193 301\nHTTPS\n \u2193\nCanonical \u2192 HTTPS\n \u2193\nSitemap \u2192 HTTPS\n \u2193\nInternal links \u2192 HTTPS<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Check after an HTTP to HTTPS migration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When a website has been newly migrated to HTTPS, you should not only check whether the homepage has a certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check systematically:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Is the HTTPS home page reachable?\n\nHTTP \u2192 HTTPS?\n\nSubpages correctly redirected?\n\nwww \/ non-www correct?\n\nCertificate valid for all required hostnames?\n\nMixed content present?\n\nInternal links to HTTPS?\n\nCanonical set to HTTPS?\n\nSitemap contains HTTPS?\n\nCheck important pages in Search Console?<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Check HTTPS version in Google Search Console<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With the Google Search Console URL inspection tool, you can check which URL Google knows and how a specific page is processed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When dealing with indexing issues, however, you should not view HTTPS in isolation. Crawlability, HTTP status, canonicals, sitemaps, and indexing directives also play a role.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can find the systematic procedure under <a href=\"\/en\/help\/seo-monitoring\/google-is-not-indexing-website\/\">Google is not indexing my website: Check causes<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Don't over dramatize Mixed Content and SEO<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Mixed content should be fixed, primarily for security, functionality, and quality reasons.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, it is hardly helpful to label every HTTPS error across the board as an \u201eSEO disaster\u201c.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The actual impact depends on which error is present and which resources or URLs are affected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technical problems should therefore be fixed based on their real cause and not because of exaggerated SEO promises.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS does not automatically make a website secure<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This difference is particularly important.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS protects data transmission between client and server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, it does not automatically protect a website against:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>insecure passwords\n\noutdated plugins\n\nmalware\n\nSQL injection\n\nstolen credentials\n\ninsecure user accounts\n\nfile manipulation\n\napplication errors<\/code><\/pre>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> A valid SSL certificate means that an encrypted connection can be established to the verified hostname. It is not a general security certificate for the entire website.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Even a hacked website can have a valid certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A compromised web server can still deliver a completely valid TLS certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The browser can then establish a technically encrypted connection, even though the website itself has been tampered with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS and application security must therefore be considered separately.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS does not protect against a fake website<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A valid certificate primarily confirms the connection to the hostname contained in the certificate. It does not confirm that a company, offer, or content is automatically trustworthy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fraudulent websites can also use HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Visitors should therefore continue to pay attention to the actual domain and context of a website.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do in case of a browser warning?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your browser warns you about a certificate or HTTPS connection, you should not simply bypass the warning permanently.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For your own website, the following diagnosis is recommended:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>note exact error message\n        \u2193\ncheck hostname\n        \u2193\nview certificate\n        \u2193\ncheck validity period\n        \u2193\ncheck SAN \/ hostname\n        \u2193\ncheck certificate chain\n        \u2193\ncheck DNS resolution\n        \u2193\nconsider proxy \/ CDN\n        \u2193\ncheck server configuration<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Don't prematurely blame the browser cache<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When troubleshooting HTTPS issues, clearing the browser cache is often recommended first.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This can be helpful in certain situations, but should not replace an actual diagnosis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the publicly served certificate has expired or is issued for the wrong hostname, clearing the regular website cache will not fix the issue.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check problem on multiple devices<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If only a single device shows a certificate warning while other current devices work without any issues, you should also investigate the local environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Possible factors are:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>incorrect system time\n\noutdated operating system\n\noutdated browser\n\nlocal proxy\n\nantivirus software\n\ncorporate network\n\nlocal certificate store<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If, on the other hand, numerous independent devices receive the same warning, it points more strongly to a server- or certificate-side issue.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error only in one network<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If HTTPS works over mobile data but not in a corporate or home network, additional local network components may be involved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Proxy\n\nFirewall\n\nDNS Resolver\n\nTLS Inspection\n\nVPN\n\nLocal filter<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Such a test helps to narrow down the cause spatially.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check system time<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Certificates have a defined period of validity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a device's date or time is significantly incorrect, a browser may evaluate a valid certificate as invalid.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With unexplained certificate warnings on just one device, checking the system time is therefore one of the simple first checks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Errors after a website migration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After a hosting or server change, HTTPS issues can arise if individual components of the transition do not yet match.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check in particular:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS pointing to new server?\n\nCertificate present on new server?\n\nAll required hostnames included?\n\nHTTP redirects correct?\n\nOld HTTP URLs in website?\n\nCDN \/ proxy updated?\n\nSitemap and canonical correct?<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">DNS changes can also take time until different resolvers use the new state. We explain more about this under <a href=\"\/en\/help\/domains-dns\/dns-propagation-erklaert\/\">DNS Propagation explained<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Error after changing the domain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If a website by:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/alte-domain.ch\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">on:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/neue-domain.ch\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">relocates, the new domain requires a suitable certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The old domain should also remain technically accessible during the migration so that redirects to the new domain can function.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A certificate error on the old HTTPS domain can hit visitors before an HTTP redirect can even be processed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why HTTPS must work before a redirection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is a frequently overlooked technical point.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a visitor accesses:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/alte-domain.ch\/seite\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Before the web server sends a response such as:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>301 Moved Permanently<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">can send, the TLS connection to the old domain must first be established.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If their certificate is invalid, the browser may display a security warning beforehand.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Practical Tip:<\/strong> During a domain migration, do not let the certificate of the old HTTPS domain expire prematurely. The old URLs must still be securely reachable so that their redirects can be processed reliably.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Do not confuse SSL certificate and email<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A certificate for the website at:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.example.com\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">is not automatically the entire TLS configuration of all other services on the domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Email services like IMAP or SMTP can use different hostnames and their own TLS connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, a working HTTPS certificate of the website does not automatically prove that all e-mail services are correctly configured.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Systematically troubleshoot HTTPS errors<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A good diagnosis follows a set sequence.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Access domain\n        \u2193\nDNS working?\n        \u2193\nServer reachable?\n        \u2193\nTLS connection possible?\n        \u2193\nCertificate valid?\n        \u2193\nHostname correct?\n        \u2193\nCertificate chain correct?\n        \u2193\nHTTP response correct?\n        \u2193\nRedirects correct?\n        \u2193\nMixed content?\n        \u2193\nApplication working?<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This prevents you from looking for problems at the wrong level.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Typical SSL and HTTPS errors<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Certificate expired\n\nCertificate not yet valid\n\nHostname does not match\n\nwww not covered\n\nSubdomain not covered\n\nCertificate chain incomplete\n\nWrong certificate served\n\nMixed Content\n\nHTTP does not redirect to HTTPS\n\nRedirect loop\n\nUnnecessary redirect chain\n\nDNS points to wrong server\n\nCDN serves different certificate\n\nOld HTTP URLs after migration\n\nCanonical points to HTTP\n\nSitemap contains old HTTP URLs\n\nOld domain loses certificate before migration is complete<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Checklist: Check SSL and HTTPS<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Open https:\/\/ directly\n        \u2193\nBrowser warning present?\n        \u2193\nOpen certificate\n        \u2193\nCheck validity period\n        \u2193\nCheck hostname \/ SAN\n        \u2193\nCheck certificate chain\n        \u2193\nOpen http:\/\/\n        \u2193\nCheck redirect to HTTPS\n        \u2193\nCheck www and non-www\n        \u2193\nCheck important subpages\n        \u2193\nOpen browser console\n        \u2193\nSearch for mixed content\n        \u2193\nCheck HTTP status\n        \u2193\nCheck DNS resolution\n        \u2193\nConsider CDN \/ proxy\n        \u2193\nCheck internal links\n        \u2193\nCheck canonical\n        \u2193\nCheck XML sitemap\n        \u2193\nControl external monitoring<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Summary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A functioning HTTPS setup consists of more than just an installed SSL certificate. The domain, DNS, certificate, web server, redirects, and the resources loaded by the website must all work together.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the event of a certificate error, you should first check whether the certificate is valid in terms of time and matches the requested hostname. Subsequently, the certificate chain, DNS resolution, server configuration, and, if applicable, CDN or reverse proxy can be investigated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mixed content is a different issue: here HTTPS works in principle, but the secure page tries to load individual resources via HTTP. Such references should be corrected at their original source.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On a website that has been completely switched to HTTPS, HTTP variants should cleanly redirect to HTTPS. Internal links, canonical URLs, and XML sitemaps should also consistently use the desired HTTPS addresses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Special care is required during domain and server migrations. The old domain also continues to require a valid certificate during an HTTPS migration if visitors access secure old URLs and are subsequently redirected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS must also not be confused with complete website security. An encrypted connection protects data transmission, but it does not prevent security vulnerabilities in WordPress, plugins, applications, or user accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Therefore, in the case of HTTPS problems, the exact error message is more important than the blanket statement \u201eSSL doesn't work.\u201c Anyone who views DNS, TLS, HTTP, and the application as separate layers will find the actual cause much faster.<\/strong><\/p>","protected":false},"excerpt":{"rendered":"<p>HTTPS geh\u00f6rt heute zum Standard einer professionellen Website. Es verschl\u00fcsselt die Verbindung zwischen Browser und Webserver und sch\u00fctzt \u00fcbertragene Daten davor, auf dem Transportweg unbemerkt mitgelesen oder ver\u00e4ndert zu werden. Dass eine Website grunds\u00e4tzlich \u00fcber https:\/\/ erreichbar ist, bedeutet allerdings noch nicht automatisch, dass die gesamte HTTPS-Konfiguration fehlerfrei ist. Ein abgelaufenes Zertifikat, ein falscher Hostname, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_joinchat":[],"footnotes":""},"doc_category":[85],"doc_tag":[],"class_list":["post-22925","docs","type-docs","status-publish","hentry","doc_category-seo-monitoring"],"year_month":"2026-09","word_count":3911,"total_views":"5","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Silvio Mazenauer","author_nicename":"admin-curia","author_url":"https:\/\/www.curiaweb.ch\/en\/author\/admin-curia\/"},"doc_category_info":[{"term_name":"SEO &amp; Monitoring","term_url":"https:\/\/www.curiaweb.ch\/en\/hilfe-kategorie\/seo-monitoring\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs\/22925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/comments?post=22925"}],"version-history":[{"count":1,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs\/22925\/revisions"}],"predecessor-version":[{"id":22927,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/docs\/22925\/revisions\/22927"}],"wp:attachment":[{"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/media?parent=22925"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/doc_category?post=22925"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.curiaweb.ch\/en\/wp-json\/wp\/v2\/doc_tag?post=22925"}],"curies":[{"name":"WP","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}