Scan rule · RSC-SEC-091
Self-signed TLS certificate
Checks whether the served certificate is vouched for by its own subject instead of a public certificate authority.
Why this matters
A certificate attests that a domain really belongs to you — and that attestation is only worth as much as whoever issues it. With a self-signed certificate, that is you. Browsers do not trust it and warn every visitor; those who click through are not protected against someone sitting between them and the server either.
It only makes sense in development and test environments. On a public site it is usually a leftover: the server was set up with a placeholder certificate, the custom domain came later and the step to a real certificate never happened.
Check it yourself: open the site in a browser — the warning mentions an “untrusted” or “self-signed” certificate.
Scan tier
How to fix it
Use a certificate from a public certificate authority (e.g. Let's Encrypt via the host) and serve the full chain.