Certificates, mixed content and HSTS — the mistakes we see most often.
Certificates, mixed content and HSTS — the mistakes we see most often.
Deploying HTTPS looks like just requesting a certificate, but the problems usually live in the details.
Pitfall one: mixed content. The page loads over HTTPS while images, scripts or fonts still use HTTP, and the browser blocks or warns, breaking styles and functions. Serve every asset over HTTPS.
Pitfall two: incomplete certificate chain. Some configurations install only the leaf certificate and omit intermediates, which triggers distrust errors in certain browsers and mobile devices.
Pitfall three: enabling HSTS too boldly. Once HSTS takes effect, browsers force HTTPS for the lifetime of max-age; if HTTPS is broken, users cannot reach the site at all. Start with a short max-age and extend it once stable.
Finally, watch expiration. Certificate lifetimes keep shrinking — configure renewal automation and expiry alerts so the whole site does not go down over an expired cert.