Wiki· Updated 17 Oct 2026

TLS and certificates

Certificate chain, legacy TLS versions and expiry — what breaks HTTPS and how to fix it.

The browser shows a padlock, yet some clients (curl, mobile apps, integrations) may not trust the site because of an incomplete chain, legacy protocols or an expired certificate.

Check the site from outside with SSL Checker. Fixes for each finding are below.

In this section

Incomplete TLS certificate chain — how to fixBrowsers open the site, but curl, Android and API clients don't. The server doesn't send the intermediate certificate.
Server supports TLS 1.0/1.1 — how to disableLegacy protocols lower the grade and aren't needed by modern clients. A safe nginx configuration.
Certificate expires soon: certbot auto-renewal and checksHow to make sure Let's Encrypt renews by itself and nginx picks up the new certificate.