Introduction
Sometimes SSL is “installed” only in name. The hosting control panel shows an active certificate, but the browser still throws an error. The problem may not be with the certificate itself, but rather with a chain of redirects, outdated links within the CMS, images loaded via HTTP, or a conflict between the proxy and the server.
Symptoms
The symptoms are usually inconsistent: the homepage loads normally, but the inner page displays a warning; it works with "www," but not without it; after logging into the admin panel, a redirect loop begins; the form doesn't submit due to mixed content; an ad link leads to the HTTP version.
What is being checked
- For which domain was the certificate issued, and does it include "www" or not?
- Does the server return the full certificate chain?
- Are there different redirect rules in Nginx, Apache, .htaccess, and CMS?
- Which address is set as the site's primary URL?
- Are there any images, scripts, forms, or iframes served via HTTP?
- Does the CDN or reverse proxy conflict with HTTPS on the origin?
- Does the certificate renewal happen automatically?
Correction Process
The test begins with an external request to several address variations: HTTP, HTTPS, www, and non-www. Next, a chain of redirects is constructed. If the chain jumps between protocols or domains, the redirects are consolidated into a single rule. After that, internal CMS links are cleaned up, mixed content is checked, and forms are tested. It’s important not to add another rule on top of the old ones, but rather to remove conflicting sources.
Normal result
After the correction, all address variations should point to a single HTTPS domain. The certificate must match the domain, the browser should not display any warnings, and forms and external resources should function without being blocked by security measures.
Conclusion
SSL is more than just clicking the “Issue Certificate” button. What matters to the user is the entire chain: which address they opened, where they were redirected, what actually loaded on the page, and whether the browser trusts it.