Issuing and checking.
WHAT TO CHECK ON A LIVE SITE
The certificate presented, its dates, and the chain.
HOW
An SSL connection command against the host and port.
WHAT TO LOOK FOR
The common name and alternative names The issuer Valid from and until Whether the chain is complete
WHY AN INCOMPLETE CHAIN MATTERS
Browsers may accept it while other clients reject it, producing intermittent reports.
HOW TO CHECK A CERTIFICATE FILE
Read it with the x509 tool, showing the text.
HOW TO CONFIRM A KEY MATCHES A CERTIFICATE
Compare the modulus of each.
WHY THAT CHECK MATTERS
Mismatched files are a common cause of a service refusing to start.
WHAT A CERTIFICATE SIGNING REQUEST IS
A request containing your details and public key.
WHAT AUTOMATED ISSUANCE PROVIDES
Free certificates, renewed automatically.
WHAT IT REQUIRES
Proving control of the domain, usually over the web or by a DNS record.
WHY RENEWAL AUTOMATION MATTERS MOST
Silent renewal failure is among the commonest causes of a site going down.
WHAT TO MONITOR
Expiry dates, with alerts well in advance.
WHAT TO CHECK AFTER INSTALLING
The site over a fresh connection, and the chain.
WHAT TO DO ABOUT MIXED CONTENT
Fix the references in the application, not the certificate.
