SHEET 06 / TLS
Encryption works only while the whole renewal path works.
A certificate can be free and still fail when DNS points elsewhere, a challenge path is blocked or automatic renewal has stopped.
01
Cover every public hostname
The certificate must include each hostname people use, commonly the root domain and www name.
02
Test automatic renewal
Do not treat an installed certificate as proof that renewal works. Run the provider test and monitor the actual expiry date.
03
Check DNS and CAA
Issuance depends on the requested hostname reaching the expected system and on any CAA restrictions allowing the chosen issuer.