How this check works
Scanaris opens a TLS connection to your domain the way a browser would and reads the certificate the server returns and the protocol negotiated. Four findings can come out of it. If the site is not served over HTTPS, high severity. If the certificate has already expired, critical. If it expires in 15 days or fewer, high; in 30 or fewer, medium. And if the server agrees to negotiate TLS 1.0 or 1.1, medium, because they are retired protocols that modern browsers reject and that allow known attacks. Ciphers and the certificate chain are not evaluated in detail here; the goal is to catch what will break your site or leave it without real encryption.
Why it matters
An expired certificate is not a discreet warning: the browser shows a full-page red screen and most visitors leave. Payment processors and API integrations fail instantly. And it is the most frequent outage of all, because a Let's Encrypt certificate lasts 90 days, the maximum allowed today is 398 and the industry has agreed to bring it down to 47 days by 2029: without automatic renewal, sooner or later it expires on a weekend. Old protocols are the other problem: a server that accepts TLS 1.0 lets an attacker on the same network force that version and decrypt the traffic.
How to fix it
Expired or about-to-expire certificate
- On Vercel, Netlify, Cloudflare, Railway or Render the certificate is issued and renewed on its own. If you see this finding there, it is almost always because the domain points elsewhere or the domain verification failed: check the DNS records in the dashboard.
- On your own server, use an ACME client (certbot or your panel's) with scheduled renewal and check that the job is active:
certbot renew --dry-runmust give no errors. - Set an external alert. Automatic renewal fails silently when the DNS changes or a token expires. Scanaris emails you at 30, 14 and 3 days.
Deprecated protocols
In nginx: ssl_protocols TLSv1.2 TLSv1.3;. In Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3. On an AWS or Google load balancer, pick a modern security policy. Managed platforms already do this.
No HTTPS
Enable the certificate on your hosting (usually a checkbox) and then the redirect from HTTP to HTTPS, which the HTTPS redirect check measures.
Check it is fixed
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -tls1_1 2>&1 | grep -iE "alert|error|no protocols" | head -1The first command shows the expiry date; the second tries to connect with TLS 1.1 and must fail. What each part of the TLS grade means is in what your TLS grade really means.
Frequently asked questions
My hosting renews automatically. Why the warning?
Because something failed in that renewal: a changed DNS record, a domain no longer pointing at the platform or an issuance limit. Open the hosting dashboard and look at the certificate status for the domain.
Is a free certificate worse?
No. It encrypts exactly the same as a paid one. Paid ones add organization validation or warranties, not more security in the connection.
Do I have to disable TLS 1.2 too?
No. Properly configured TLS 1.2 is still secure and needed by some clients. What has to go is 1.0 and 1.1.