Certificate is self-signed

CriticalConfirmedtls.certificate.self-signed

What this check looks for

The certificate vouches for itself. Nobody else has confirmed the site is who it says it is, so browsers treat it as untrusted.

Why it matters

A self-signed certificate encrypts the connection but proves nothing about who is on the other end, which is the half that stops interception. Visitors get a warning that is indistinguishable from a real attack.

When the check passes, your report says: “The certificate was issued by an authority, not by itself”.

What it costs your score

When this check fails it removes 55 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity: critical
Default confidence: confirmed
Status when triggered: fail
Deduction: 55 points
Family cap: tls.certificate · 60
Category: TLS
Module: Tls certificate
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Replace it with a certificate from a publicly trusted CA.

Self-signed proves nothing to anyone who does not already have the certificate.

Point a DNS name at the host and issue a free certificate over ACME.
If the host is genuinely internal, keep the self-signed certificate and distribute your CA root to the machines that need it — but then it should not be publicly reachable either.

How to confirm it worked

openssl s_client -connect ‹host›:443 -servername ‹host› </dev/null 2>&1 | grep 'Verify return code'

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx

certbot --nginx -d ‹host›

Apache

certbot --apache -d ‹host›

Caddy

‹host› {
	# No tls directive: Caddy obtains a public certificate itself.
	file_server
}

Technical detail

The certificate for ‹host› names ‹issuer› as both its subject and its issuer, and nothing else was presented. This is normal on a staging box and never acceptable on a host the public reaches. Free automated certificates from a public CA have made the trade-off that used to justify self-signing obsolete.