Self-Signed Certificate

What it means

The certificate presented by this domain was signed by itself, or by a private CA, rather than by a Certificate Authority that browsers and operating systems trust out of the box. Browsers cannot build a trust chain to a root they recognize, so they show a warning even though the connection may still be encrypted.

Why it matters

Self-signed certificates in production defeat the identity-verification purpose of TLS: encryption without trusted identity verification does not protect against an attacker presenting their own self-signed certificate for the same domain. Visitors are trained to distrust the browser warning this produces, which also damages credibility even for legitimate internal or staging use that leaked into a public-facing hostname.

What Nivaronix checks

Nivaronix checks whether the certificate's issuer matches its own subject (a signature of self-signing) and whether the chain resolves to a CA present in standard trust stores. This is a certificate-trust check, not a scan for server-side vulnerabilities.

Example evidence

Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.

Illustrative example only — not a live scan result.

Certificate: CN=internal-app.example.com
Issuer: CN=internal-app.example.com  (self-issued)
Trust chain: does not resolve to a public root CA
Status: SELF-SIGNED — NOT TRUSTED BY BROWSERS

How to fix it

• Do not use self-signed certificates on any publicly reachable production hostname.
• Generate a certificate from a real Certificate Authority — Let's Encrypt (free, automatable via ACME) covers the vast majority of use cases.
• If the certificate is managed by a CDN or load balancer (Cloudflare, AWS ACM, etc.), enable their managed TLS certificate feature instead of uploading a self-signed one.
• Reserve self-signed certificates for genuinely internal, non-public services, and keep them off any hostname that resolves publicly.

How to verify the fix

Re-run the SSL/TLS checker against the domain and confirm the certificate now chains to a trusted public root. In a browser, the padlock should show with no interstitial warning.