SSL/TLS Security

What this check looks for

StackShield opens a TLS connection to your domain and inspects what the server offers: the certificate's validity and expiry, the protocol versions it will negotiate, and the cipher suites it accepts. It is reading whether the encrypted channel your users rely on is actually strong, or strong in name only.

A padlock in the address bar says the connection is encrypted. It says nothing about whether that encryption is current.

Why it matters

TLS protects every credential, session cookie and piece of data that moves between your users and your server. When a server still negotiates TLS 1.0 or 1.1, or accepts weak cipher suites, an attacker positioned on the network has known avenues to downgrade or weaken the connection. An expired or misconfigured certificate breaks trust outright, and browsers will warn users away.

Certificate expiry is the quiet one. Certificates are valid for a fixed window, and a renewal that silently fails takes the whole site down when the certificate lapses, usually at the worst moment.

What a failed check means

A failed check means one of three things: your certificate is expiring soon or misconfigured, your server negotiates an outdated protocol, or it accepts weak ciphers. The first is an availability risk, the other two weaken the confidentiality the whole channel exists to provide.

The fix is disabling old protocols, restricting cipher suites to modern ones, and monitoring certificate expiry so renewal never surprises you.

See the step-by-step remediation: how to fix this.