SSL/TLS Certificate Validity, Handshakes & Renewal Thresholds

Overview of the SSL/TLS Handshake Check#

Transport Layer Security (TLS) is the fundamental protocol securing all modern internet communication. Without valid, properly configured TLS certificates, browser sessions are vulnerable to man-in-the-middle (MITM) eavesdropping, cleartext packet sniffing, and credential theft.

SiteSecura's TLS scanning module performs real-time cryptographic handshakes against port 443 of your target domain to evaluate protocol support, certificate authenticity, host matching, and remaining validity lifespan.

---

What SiteSecura Checks#

Our scanning engine evaluates the following cryptographic parameters during every audit:

1. Protocol Negotiation (TLS Versions)#

• TLS 1.3 & TLS 1.2: PASS. Both protocols provide robust modern cipher suites and forward secrecy.
• TLS 1.0 & TLS 1.1: FAIL (High Severity, -15 pts). Both versions are formally deprecated by RFC 8996 due to fundamental cryptographic vulnerabilities (e.g., POODLE, BEAST, weak CBC ciphers).
• SSL 2.0 & SSL 3.0: FAIL (Critical Severity, -30 pts). Insecure legacy protocols.

2. Certificate Validity & Expiration Countdown#

The engine parses the certificate's notBefore and notAfter timestamps:

• Expired Certificate: FAIL (Critical Severity, -30 pts). Immediately triggers major browser warnings (e.g., NET::ERR_CERT_DATE_INVALID).
• Expiring in $\le$ 7 Days: WARNING (Medium Severity, -5 pts). Critical renewal window.
• Expiring in $\le$ 14 Days: WARNING (Low Severity, -2 pts). Escalated renewal warning.
• Expiring in $\le$ 30 Days: INFO (0 pts). Proactive renewal notice.

3. Subject Alternative Name (SAN) Host Matching#

The certificate must explicitly cover the requested hostname:

• Exact Match or Wildcard: PASS (e.g. example.com matches example.com or *.example.com).
• Mismatch: FAIL (Critical Severity, -30 pts). Triggers browser warning SSL_ERROR_BAD_CERT_DOMAIN.

4. Certificate Authority (CA) Chain of Trust#

The certificate must be signed by a recognized root certificate authority in the standard Mozilla/NSS trust store. Self-signed certificates on public endpoints fail validation.

---

Web Server Configuration Hardening#

To ensure your web server only negotiates modern TLS protocols and strong cipher suites, apply the following configurations:

Nginx Configuration#

Edit your server block (typically in /etc/nginx/sites-available/default):

NGINX
Copy
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Enforce TLS 1.2 and 1.3 only
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    # Modern forward-secret cipher suites
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # Session caching
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
}

Apache Configuration#

Edit your VirtualHost configuration (typically in /etc/apache2/sites-available/default-ssl.conf):

APACHE
Copy
<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem

    # Disable legacy SSL and TLS 1.0/1.1
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

    # Enforce strong ciphers
    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES:!CAMELLIA:!SRP:!PSK
    SSLHonorCipherOrder on
</VirtualHost>

Caddy (Automatic HTTPS)#

Caddy automatically manages certificates and enforces TLS 1.2/1.3 by default:

CADDY
Copy
example.com {
    tls {
        protocols tls1.2 tls1.3
    }
    reverse_proxy localhost:8080
}

---

Verifying Your TLS Configuration#

After reloading your web server configuration, test your endpoint immediately using SiteSecura's free standalone SSL/TLS Certificate Checker. The tool performs an immediate handshake and returns the active protocol versions, cipher suite, issuer authority, and days until expiration.