What must be ready before issuance?
Identify the main hostname, www and any other names the site uses. Check DNS and IIS bindings for each one. The certificate’s SAN list defines coverage; a certificate for the apex domain does not automatically include www.
With HTTP-01 validation, the certificate authority reaches the domain on TCP 80. Router rules, firewalls or blocked challenge paths can interrupt validation. Diagnose the access problem before repeating failed issuance requests.
Issuing or importing a certificate
- Open the site’s SSL area and inspect hostname coverage and the existing certificate.
- Request a new Let's Encrypt certificate when needed; retain a working certificate when replacement has no purpose.
- For an import, verify that the private key matches and the required intermediate chain is available.
- Check the IIS HTTPS binding’s hostname, port and certificate selection.
- Connect from another network using the real hostname and validate name, chain and lifetime.
- After HTTPS works, test HTTP redirects and the preferred www or apex address.
How should automatic renewal be monitored?
Inspect the SSL renewal schedule and last job result in Automation. DNS and the validation path must remain reachable before expiry. An enabled schedule is not evidence that the most recent renewal succeeded.
After renewal, compare the new expiry date in the panel with a real TLS connection. If certificate files were replaced but the service still presents the old certificate, binding or reload work may remain.
Do web, mail and FTP share certificate settings?
A certificate can serve multiple services when it covers the relevant names. Each service still needs its own application and connection test. Disabling certificate validation does not repair a trust failure.
| Service | Connection to test | Important distinction |
|---|---|---|
| IIS website | HTTPS using the domain | Binding and SNI selection |
| Stalwart mail | 587 STARTTLS and 465 TLS | Apply the certificate, chain and key to the mail service |
| FTP TLS | A real FTPS client connection | FTP certificate and TLS policy |
Distinguishing common TLS failures
A name mismatch points to the wrong hostname or coverage. A trust failure can indicate a missing intermediate or an untrusted issuer. A lifetime error concerns validity dates. For resets and timeouts, start with port reachability and IIS bindings: the connection may fail before any certificate is received.
Frequently asked questions
Can a redirect fix a www certificate error?
No. TLS negotiation happens before an HTTPS redirect, so www needs a valid certificate too.
Should mail certificates be tested separately from web SSL?
Yes. A successful IIS connection does not prove SMTP serves the same certificate. Test the relevant SMTP ports independently.