Fifteen minutes once a year.
CHECK WHAT IS INSTALLED
cPanel > SSL/TLS Status. Every domain, subdomain and alias should show a valid certificate with an expiry date in the future.
Anything showing a warning, or marked excluded, needs attention.
CHECK RENEWAL IS WORKING
Expiry dates should be moving forward over time. A date that has not changed in a year means renewal is not happening.
CHECK PURCHASED CERTIFICATES
Note expiry dates and set calendar reminders. Consider whether they are still needed or whether AutoSSL would serve.
CHECK THE CONFIGURATION
Run an online SSL checker. Confirm the chain is complete and the grade is reasonable.
CHECK THE REDIRECTS
Test all four URL forms for a single-hop redirect to your canonical form.
CHECK MIXED CONTENT
Scan several pages, including recently added content.
CHECK CONTACT DETAILS
The cPanel contact address, where failure notices go. Current, monitored, and not on a domain we host.
CHECK CLOUDFLARE
SSL/TLS mode still Full (strict), mail records still DNS-only.
