Security
HTTPS not working: test DNS, TLS and web-server layers
HTTPS depends on several layers succeeding in order. A valid certificate cannot help when DNS points to the wrong IP, and an open port cannot help when the server presents a certificate for another hostname.
Start with DNS
Resolve the hostname and confirm it points to the intended public endpoint. Check both A and AAAA records; a broken IPv6 path can affect clients even when IPv4 works.
Verify TCP reachability on port 443
Check provider and host firewalls, reverse-proxy listening sockets, and network routes. A connection timeout or refusal occurs before certificate validation.
Inspect the TLS handshake and certificate
Confirm hostname coverage, validity, trust chain, and the certificate being served by the public virtual host. If a CDN or proxy terminates TLS, inspect that edge as well as the origin when relevant.
Then troubleshoot the HTTP application response
Once TLS succeeds, HTTP 404, 500, 502, redirect loops, or application errors are separate problems. Do not keep replacing certificates after the secure connection is already established.