TLS Certificate Checklist

Pre-flight checklist before deploying a new TLS certificate.

• Certificate matches expected hostname (CN or SAN)
• Wildcard scope is correct (e.g. *.example.com ≠ example.com)
• Issued by a public CA in the major browser trust stores
• Full certificate chain bundled (server + intermediates), not just leaf
• Validity period ≥ 30 days before expiry
• Renewal automation is in place (cron / certbot / acme.sh)
• Private key permissions are 600; not committed to git
• Key size is ≥ 2048 RSA or 256-bit ECDSA
• Signature algorithm is SHA-256 or stronger
• Tested against SSL Labs (target A or A+)
• HSTS header is enabled with reasonable max-age (≥ 6 months)
• HTTP redirect to HTTPS configured
• OCSP stapling enabled
• Old protocols disabled (TLS 1.0 / 1.1 / SSL 3.0)
• Weak ciphers disabled (RC4, 3DES, NULL, EXPORT)
• Certificate Transparency log entry confirmed (search crt.sh)
• CAA DNS record allows your issuer
• Monitoring + alerting for cert expiry