How to Check an SSL Certificate and the “Not Secure” Warning

A security warning in the browser does not come down to a single cause. A valid certificate does not mean that all links and resources on the page are configured correctly. Start by reading the full address and the details the browser shows.

What's in this guide?

• Distinguish between HTTP and HTTPS addresses
• Check the certificate's coverage
• Find the sources of mixed content
• Read the AutoSSL validation error
• Test again after a migration

Distinguish between HTTP and HTTPS addresses

Check in the address bar that the page loads over HTTPS. Even if you have a valid certificate, a connection over HTTP is not encrypted. Once HTTPS is confirmed to work, you can plan a redirect from HTTP to HTTPS. Setting up the same redirect repeatedly in the application, the server and the CDN can cause a redirect loop.

Check the certificate's coverage

Review the certificate coverage separately for the root domain, www and other subdomains. The certificate's validity period, name matching and chain of trust are important. The www address working does not mean the root address is automatically served correctly with the same certificate. Run the test on the actual address visitors use.

Find the sources of mixed content

An HTTPS page may contain images, scripts, stylesheets or other resources loaded over HTTP. Review the relevant warnings in the browser's developer tools. The application's base URL, old links in the database and theme settings are the points to check. Instead of just changing resource addresses as text, verify that the new HTTPS address is actually accessible.

Read the AutoSSL validation error

The cPanel SSL/TLS Status screen shows the certificate status of your domain names. An automatic certificate requires domain control validation. The process may fail if DNS points to the wrong target or if requests to the validation file are blocked. A 404 during HTTP validation means the requested file could not be found on that server; on its own, it does not identify the exact source of the problem.

Test again after a migration

On the new server, check the domain mapping, DNS, certificate and application URL together. After clearing caches, also try a different browser. Review not only the home page but also the addresses that open during login, forms, the client area and the payment flow. Do not try to fix a certificate error permanently by bypassing the browser warning.

Example: valid certificate, but still a warning

On a site, the certificate may appear valid while the admin page loads over HTTP. In another scenario, the page uses HTTPS, but HTTP resources belonging to an old domain name are loaded. These two situations require different fixes. Reviewing the address, certificate details and resource warnings together helps you avoid changing the wrong setting.

Practical checklist

• Check that the actual address uses HTTPS.
• Compare coverage for www and the root domain.
• Review the browser's resource warnings.
• Go over the DNS and AutoSSL validation records.

Frequently asked questions

Does SSL cover all subdomains?

It depends on the names the certificate includes and on its type. Verify the coverage for every address you use.

Does getting a new certificate fix mixed content?

Mixed content relates to the resource addresses in the application. Those links need to be fixed separately.

Related guides

• DNS Records: What Do A, AAAA, CNAME, MX, TXT and NS Do?
• DNS Propagation and TTL: Why Don't Changes Appear for Everyone at the Same Time?
• Site Migration Guide: DNS, HTTPS and SEO Redirect Checks

Technical reference: cPanel SSL/TLS Status. Check the current official documentation for product and version details.

Contact us with your SSL and migration questions →