SSL certificate and DNSSEC:
is everything in order?
Free SSL/TLS certificate check: validity, expiry date, issuer, chain, covered names, TLS version, HSTS and HTTPS redirect, plus the domain’s DNSSEC signature.
Examples: google.com wikipedia.org github.com
A well-configured HTTPS
What browsers check before showing the padlock.
The site certificate is signed by an intermediate authority, itself signed by a root the browser knows.
The certificate must cover the exact name (or a *.domain wildcard) and be within its validity, 90 days at Let’s Encrypt.
TLS 1.2 at least, ideally 1.3, with HSTS to forbid any fallback to unencrypted HTTP.
FAQ
Why is my certificate “not trusted”?
Most often the server does not send the authority’s intermediate certificate, so browsers cannot build the chain. Install the “fullchain” file from your authority (Let’s Encrypt creates it automatically). A self-signed or expired certificate is also refused.
What is HSTS?
The Strict-Transport-Security header makes browsers always use HTTPS for your site, even if someone types “http://”. At least 6 months (max-age=15552000) is recommended, and one year to join the “preload” list.
How do I enable DNSSEC?
Turn on zone signing at your DNS host (Cloudflare, OVHcloud, Gandi… do it in one click), then publish the DS record it gives you at your registrar. If the registrar and DNS host are the same company, it is often automatic.