Transport security
SSL and TLS checklist for a production SaaS
Check certificate trust and expiry, HTTPS redirects, HSTS, mixed content, cookies, and redirect chains before they become incidents.
A valid padlock is the beginning of transport security, not the end. SaaS traffic can still pass through an HTTP redirect, load an insecure asset, or lose cookie protection because one layer of the stack sees the wrong protocol.
Treat TLS as a path from the first request to the final application response. Every hop matters.
Verify the certificate as a customer sees it
Check the production hostname with Server Name Indication, confirm the certificate chain is trusted, and record the expiry date. If your platform renews certificates automatically, alerting still matters. DNS changes, failed challenges, or an abandoned custom domain can interrupt renewal.
Auto-renewal still needs monitoring
Expired without replacement: browsers may reject the connection. Automatic renewal is a mechanism, not evidence that renewal succeeded.
A certificate is issued, renewal is attempted before expiry, and successful renewal replaces the certificate. A failed renewal can reach expiry and break trust. Monitor the actual expiry date; no universal duration is assumed.
- The certificate covers the exact hostname users visit.
- The full chain is trusted by common clients.
- Expiry monitoring leaves enough time to investigate a failed renewal.
- Old or customer-managed domains have a clear ownership and removal process.
Make the first redirect secure and direct
An HTTP request should move straight to the final HTTPS hostname. Avoid a chain that first adds www, then adds HTTPS, then changes a trailing slash. Each extra hop is slower and creates another configuration surface.
Update internal links, canonical URLs, emails, and marketing redirects to point at the final HTTPS destination. Redirects are a fallback, not a substitute for correct links.
Check the layers behind the proxy
Many SaaS apps terminate TLS at a CDN or load balancer. The application must trust forwarded protocol headers only from known proxies. Otherwise it may create HTTP links, skip Secure cookies, or enter a redirect loop.
- Set session cookies with Secure, HttpOnly, and an intentional SameSite policy.
- Search rendered HTML and CSS for http:// assets or form actions.
- Confirm webhooks and API callbacks use current TLS endpoints.
- Recheck transport behavior after CDN, proxy, or custom-domain changes.
Add HSTS after the route is clean
Once HTTPS works across the required hostnames, add HSTS in stages. A short first max-age makes mistakes recoverable. Increase it after normal product traffic, login, billing, and subdomains have been exercised.
Check your production site
See which of these issues are visible now.
ScanMySaaS checks the public surface and keeps the affected URL with every finding. Verify results before changing production.
Run a free scan