Overview
SSL Monitor helps you identify, prioritize and resolve SSL/TLS issues on your monitored domain. Once a scan has completed, your results are shown in the SSL Monitor dashboard for that domain. So you can review your certificate health, spot configuration weaknesses and take action to fix them.
Your Dashboard
Your dashboard gives you a summary of everything SSL Monitor found on your domain. This helps you quickly understand which issues need attention and where to focus first.
From the dashboard, you can view information such as:
- Your overall SSL Security Rating
- The date of your last scan and when the next scan is due
- Vulnerabilities found, including insecure ciphers and outdated SSL/TLS versions
- Certificate trust checks, such as revocation status and chain of trust
- Certificate expiration date and days remaining
- HTTPS configuration checks, including HTTP redirect and mixed content
- Subdomain SSL monitoring results
- Your notification and alert settings
You can also download or share your report, and trigger a new scan at any time using the “Run scan again” button.
The dashboard is designed to help you move from detection to action. Start with any Critical findings, such as a broken chain of trust or an expiring certificate, then work through the remaining issues.
Understanding Your SSL Security Rating
Your SSL Security Rating summarizes the overall health of your domain’s SSL/TLS setup in a single grade, displayed on the gauge at the top of your dashboard.
The rating takes into account the quality of your SSL/TLS configuration, certificate trust, HTTPS configuration, mixed content and expired certificates. Expiring certificates that have not yet expired. Note: Subdomain SSL Monitoring results, do not currently affect the SSL Security Rating.
The ratings are:
- Very Good: Indicates robust commercial security with minimal or no issues, demonstrating adherence to the latest compliance and encryption best practices.
- Good: Indicates adequate adherence to security and compliance best practices, with some issues that could be improved.
- Fair: Indicates that issues have been discovered which should be addressed to ensure security and confidentiality of data.
- Poor: Indicates that significant issues have been found which must be addressed to ensure security and confidentiality of data.
- Critical: Indicates that one or more critical issues have been found that need immediate attention.
Certificate Trust
The Certificate Trust section confirms that browsers and devices will accept your certificate. Each check shows a clear pass or fail result:
- Not Revoked: Your certificate has not been revoked by the issuing CA.
- Trusted CA: Your certificate was issued by a certificate authority that browsers trust.
- Hostname Match: The certificate matches the domain it is being served on.
- Intermediate Cert Included: Your server is sending the intermediate certificate.
- Certificate Chain of Trust: The full chain from your certificate to a trusted root is valid and complete.
A failed trust check is usually a Critical risk, because it can cause browsers to show security warnings to your visitors. These findings should be your first priority.
Certificate Details and Expiration
The Certificate Details section shows you the key facts about the certificate currently installed on your domain, including:
- Expiration date and days remaining
- The common name and any additional domains (SANs) the certificate covers
- The issuing organization, intermediate and root certificate
- Certificate type, for example DV
- Key usage and extended key usage
- Authority Information Access (AIA) and OCSP stapling status
The Certificate Expiration card keeps the expiry date and countdown visible at all times.
Vulnerabilities
The Vulnerabilities section tests your domain against known SSL/TLS weaknesses, grouped into three areas:
- Exploits: Named attacks such as Heartbleed, BEAST, POODLE, DROWN and LOGJAM. A tick means your domain is not affected. A warning means the exploit is possible against your current configuration.
- Outdated SSL/TLS Versions: Checks for deprecated protocols such as SSLv2, SSLv3, TLS 1.0 and TLS 1.1. Supporting these older versions exposes your visitors to downgrade attacks.
- Insecure Cipher Suites: Checks for weak or obsolete ciphers, such as NULL ciphers, export-grade ciphers and Triple DES.
Alongside these, the Recommended Features list highlights modern protections you could enable, such as TLS 1.3, HSTS, OCSP stapling, a CAA record and ALPN/HTTP2. These are not vulnerabilities, but enabling them strengthens your overall configuration and can improve your rating.
Each finding is given a risk level to help you decide what to fix first.
HTTPS Configuration
This section checks how your site handles secure connections in practice:
- HTTP/HTTPS Redirect: Confirms visitors who arrive over HTTP are redirected to HTTPS.
- Mixed Content: Confirms your HTTPS pages are not loading resources, such as images or scripts, over insecure HTTP.
Both checks show a clear pass or fail result.
Reviewing an Issue
Any finding marked with a warning includes a “Details” link. Selecting it opens the Vulnerability Remediation Steps report, which gives you everything you need to understand and fix the issue:
- Overview: The vulnerability name, the affected domain and the risk level.
- Systems Affected: Which systems or configurations the issue applies to.
- Description: A plain-English explanation of the issue, why it matters and links to further reading.
- Remediation Info: The recommended action to resolve the issue, with step-by-step guidance for common platforms such as Apache, NGINX and Windows servers.
- Raw Scanner Results: The exact output from the scanner, including the host, port and IP address tested, so you can verify the finding yourself.
You can share the full report with a colleague or your hosting provider using the “Share Report” button.
Using Remediation Advice
Remediation advice explains the recommended action to resolve the finding. This may include disabling an outdated protocol, removing weak cipher suites, updating your server configuration or renewing and reinstalling your certificate.
Before making changes, check whether anything still depends on the affected configuration. For example, disabling TLS 1.0 is recommended, but confirm that no legacy clients or integrations still require it.
For production systems, plan remediation carefully. Some changes require a web server restart or a scheduled maintenance window.
Subdomain SSL Monitoring
SSL Monitor automatically detects subdomains attached to your domain and monitors their certificates. For each subdomain, the dashboard shows:
- Scan status, which you can toggle on or off per subdomain
- Certificate trust status and the number of issues found
- Certificate expiration date
- Last scan date
Confirming Fixes
Scans run on a regular schedule, but you do not need to wait for the next scheduled scan. After applying a fix, select “Run scan again” on your dashboard to check whether the issue has been resolved.
Note that some sections of your dashboard update on different schedules. Certificate checks run more frequently than full vulnerability scans, so each card shows the date and time it was last updated.
If an issue remains after remediation, review the recommendation again and check whether:
- The change was applied to the correct server or domain
- The web server was restarted after the configuration change
- A CDN, load balancer or proxy in front of your server is overriding your configuration
- The issue applies to a subdomain rather than the primary domain