Certificates for things other than web pages.
WHY IT MATTERS
An API accepting credentials or returning data over plain http exposes everything in transit. The same certificate securing your website secures your API endpoints, provided they are on a covered hostname.
WHAT TO CHECK
The endpoint hostname is covered by your certificate. An API on api.yourdomain.com needs that subdomain included. The endpoint enforces https and refuses plain http rather than redirecting, since a redirect means the first request already travelled insecurely. Clients connecting to you verify the certificate rather than skipping the check.
FOR CLIENTS YOU CONTROL
Ensure they validate certificates. Many libraries allow verification to be disabled, and developers disable it to make something work during testing and forget to re-enable it. That removes the protection entirely.
COMMON PROBLEM
An old integration failing after a server upgrade, because the client only supports obsolete TLS versions. The client needs updating, not the server weakening.
TESTING
Use a command-line tool or an online checker against the endpoint hostname specifically, not just the main domain.
