Question 1

What SSL grade should my website have?

Accepted Answer

Aim for an A or A+ SSL grade on tools like Qualys SSL Labs. An A+ grade requires: TLS 1.2 and 1.3 support, TLS 1.0 and 1.1 disabled, a valid certificate chain from a trusted CA, HSTS enabled with a long max-age (at least 1 year), no weak cipher suites (RC4, 3DES, DES), and OCSP stapling. An A grade meets all requirements but may lack HSTS. B or lower grades often indicate outdated TLS versions or weak cipher suites that could compromise user data.

Question 2

How far in advance should I renew my SSL certificate?

Accepted Answer

Renew your SSL certificate at least 30 days before it expires — ideally 60 days before if you manage renewal manually. Many certificate authorities send expiry warnings at 90, 60, and 30 days. Since 2020, the maximum validity period for SSL certificates is 398 days (about 13 months). For Let's Encrypt certificates (90-day validity), configure Certbot or your hosting to auto-renew at 60 days. An expired SSL certificate causes browser warnings, blocks all HTTPS traffic, and can cause a significant Google ranking drop.

SSL/TLS Certificate Checker

What gets checked