Network HTTPS config check

HTTPS Readiness test

Domain analysis: twitter.com

Always redirect to same domain https://twitter.com (BEST PRACTICE!)

IP address: 104.244.42.1

Certificate details

This SSL Certificate was created especially for twitter.com

Certificate issued by DigiCert Inc, of type DigiCert SHA2 High Assurance Server CA

Certificate start date: Mar 26 00:00:00 2020 GMT

Certificate expiration: Mar 25 12:00:00 2021 GMT (in 62 days)

Certificate validity period: 1 year(s) => commercial (paid) certificate

Encryption algorithm: TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256

More certificate details?

SSL Labs: get more detailed HTTPS report

Mozilla Observatory: get more detailed HTTPS report

HTTPS Headers

Missing HTTP header x-xss-protection - should be 1; mode=block

HTTP header x-frame-options is OK - iframe clickjacking protection

HTTP header content-security-policy is OK - cross-scripting protection

HTTP header strict-transport-security (HSTS) is OK (243 months valid)

For a GDPR-focused review of your domain, use Churlie GDPR Checkup

Content details

No mixed content: no http files used in the https page

How to get https for your site

Let’s Encrypt is a free, automated, and open Certificate Authority.
Example: cloudfleet.io, scotthelme.co.uk

Cloudflare One-Click SSL (also on the Free Plan)
Example: toolstud.io

Paid certificates: Verisign, GeoTrust, Comodo, DigiCert, Thawte, Globalsign
Example: www.amazon.com, www.mozilla.org, twitter.com

References

Google Chrome and/or Search will punish your website for insecure content and practices. In short, every site should be https://, and should send every visitor of their http:// site to the secure one.

Google Chrome: Our plan to label HTTP sites as non-secure is taking place in gradual steps

Data Security Action Plan, step 1: Implement strict encryption measures on all network traffic

BuiltWith: SSL by Default Usage Statistics

Analysis of the Alexa Top 1M sites: HTTPS, HSTS, CSP