Skip to content
DomainGrade

What we checkCertificate & HTTPSTL-05

Certificate covers your domain

The certificate must be valid for both your domain and its www form.

Area
Certificate & HTTPS
Check
TL-05
Included
Free in every scan

What we check

We read the Subject Alternative Names and check your domain and www.yourdomain are both covered, directly or by a wildcard.

Why it matters

A certificate for yourcompany.com alone produces a browser warning for anyone who types www. — and plenty of people still do, as do older links and printed material.

Whichever name is missing, the failure is invisible to whoever configured it — they use the name that works.

It also compounds with redirects. A site that redirects www to the apex still has to complete a TLS handshake on www first, so a certificate that omits it produces a warning before the redirect ever runs.

How to fix it

  1. 1

    Reissue the certificate with both names.

  2. 2

    Most issuers include the www variant by default; if yours does not, add it explicitly.

Common questions

I redirect www to the apex. Do I still need it on the certificate?
Yes. The TLS handshake happens before the redirect, so a visitor hitting https://www. sees the warning first and never reaches the redirect.
Does a wildcard cover the apex?
No — *.yourcompany.com covers subdomains but not yourcompany.com itself. You need both names.
What about the Common Name field?
Browsers stopped using it years ago; only the Subject Alternative Names matter now.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other certificate & https checks