Testing and Validating Your SSL Configuration

After setting up SSL, you must verify that your configuration is secure. Misconfigurations can leave your site vulnerable even with a valid certificate.

Online Testing Tools

SSL Labs Server Test (ssllabs.com/ssltest):
The gold standard for SSL testing. It checks:

• Certificate validity and chain

• Protocol support (TLS 1.2, 1.3)

• Cipher suite strength

• Known vulnerabilities (BEAST, POODLE, Heartbleed)

• HSTS configuration

Aim for an A+ rating.

Command-Line Testing

OpenSSL:

# Test connection and view certificate
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com
Check certificate expiration

openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates
Check supported TLS versions

openssl s_client -connect yourdomain.com:443 -tls1_2
openssl s_client -connect yourdomain.com:443 -tls1_3

cURL:

# Check HTTPS response and headers
curl -I https://yourdomain.com
Verbose SSL info

curl -vI https://yourdomain.com 2>&1 | grep -E 'SSL|TLS|certificate'

Nmap:

# Enumerate supported ciphers
nmap --script ssl-enum-ciphers -p 443 yourdomain.com

PHP-Level Validation Script

Create a test script to verify your PHP configuration:

header('Content-Type: text/plain');
$checks = [
    'HTTPS active' => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',
    'Session cookie secure' => (bool)ini_get('session.cookie_secure'),
    'Session cookie httponly' => (bool)ini_get('session.cookie_httponly'),
    'Session use only cookies' => (bool)ini_get('session.use_only_cookies'),
    'Trans SID disabled' => !ini_get('session.use_trans_sid'),
    'Strict mode enabled' => (bool)ini_get('session.use_strict_mode'),
];
foreach ($checks as $name => $passed) {
    echo sprintf("[%s] %s\n", $passed ? 'PASS' : 'FAIL', $name);
}

Security Headers to Verify

Beyond SSL itself, check these security headers:

// Content Security Policy
header("Content-Security-Policy: default-src 'self'; script-src 'self'");
// Prevent MIME sniffing
header('X-Content-Type-Options: nosniff');
// Clickjacking protection
header('X-Frame-Options: SAMEORIGIN');
// XSS protection (legacy browsers)
header('X-XSS-Protection: 1; mode=block');
// Referrer policy
header('Referrer-Policy: strict-origin-when-cross-origin');

Automated Monitoring

Set up monitoring for certificate expiration:

# Cron job to check cert expiry (alert 30 days before)
0 0 * * * /usr/bin/openssl s_client -connect yourdomain.com:443 2>/dev/null \
  | openssl x509 -noout -checkend 2592000 || echo "Certificate expiring soon!"

Checklist Before Going Live

• Certificate valid and properly chained

• TLS 1.2+ only (disable SSLv3, TLS 1.0, TLS 1.1)

• Strong cipher suites (AES-256, ChaCha20)

• HSTS header present with long max-age

• HTTP to HTTPS redirect working

• PHP session cookies marked secure

• SSL Labs score: A or A+

• Certificate auto-renewal tested