Check the certificate name and validity

A browser validates that the certificate covers the requested hostname, is within its validity period and chains to a trusted authority. A certificate for example.com may not cover www.example.com unless the name appears in the certificate SANs. Renewal, intermediate certificates and system time can also cause failures.

Understand SNI and virtual hosts

SNI lets one HTTPS address serve different hostnames. The client sends the requested hostname during TLS, and the server or proxy must select the matching certificate and virtual host. An IP address test or a missing SNI configuration can show a different certificate from a normal browser request.

Test root and www separately

Check the bare domain and www as independent endpoints. Confirm DNS, certificate coverage, HTTP status, final URL and content for each. Decide which hostname is canonical and configure one clear permanent redirect rather than several competing rules.

Read redirect status and location

301 and 308 normally indicate a permanent move; 302 and 307 are temporary. Inspect the Location target, scheme, hostname, path and query. A redirect to HTTP, an unexpected host or a changing path can reveal a proxy or application configuration error.

Find redirect loops and long chains

A loop occurs when one rule sends the request back to an earlier URL, such as a proxy terminating HTTPS while the origin believes the request is HTTP. Forwarded protocol headers, application URL settings and duplicate web-server rules are common causes. Keep the chain short and test every hop.

Check proxy and origin TLS modes

If a CDN or reverse proxy terminates TLS, confirm its client-facing certificate and its connection mode to the origin. A proxy configured for HTTPS to an origin that only serves HTTP, or an origin certificate that does not match the hostname expected by the proxy, can produce handshake errors or 5xx responses.

Use diagnostics safely

Website Diagnostics can show HTTPS status, response time, final URL and headers without relying only on browser cache. Compare the result with a normal browser and test after clearing relevant caches. Do not submit credentials or private URLs to a public diagnostic tool.

A repeatable checklist

Test HTTP and HTTPS, root and www; inspect the certificate and SNI; record each status and Location; identify the canonical hostname; remove conflicting rules; verify proxy-to-origin TLS; then retest from more than one network.

Check real data now

Use the live IIPP tool to inspect the domain or IP address you are working with.

Website Diagnostics →