About this checker

Source notice

वेबसाइटहरू सुरक्षित गर्नका लागि Valid SSL/TLS Certificate अनिवार्य रूपमा लागू गर्ने सम्बन्धमा।

Issuer

National Cyber Security Centre (NCSC), Nepal

Reference

प.सं. ०८३/८४, च.नं. १११

Letter date

B.S. 2083-07-11 (2026-10-28 A.D., derived)

Notice

ncsc.gov.np notice page · PDF

The circular is addressed to federal and provincial government bodies and to local-government associations. The tool applies it as a technical baseline to any website. This does not mean every tested website is legally subject to it.

What is checked

Policy version ncsc-2083-07-11/v1 draft — under owner review. Each report records the policy version it was evaluated with.

• certificate_present Circular-derived · mandatory

  The HTTPS endpoint presents an SSL/TLS certificate.

• certificate_dates Circular-derived · mandatory

  At scan time, the leaf certificate is neither expired nor not yet valid.

• hostname_match Validity interpretation · mandatory

  The certificate's Subject Alternative Names cover the submitted hostname. The circular requires a "Valid" certificate, which we take to include matching the site it is served for.

• trusted_chain Trusted-issuer interpretation · mandatory

  The served chain builds to a root in the pinned trust store recorded on the report. We take this to mean "issued by an authorized and trusted certificate-issuing body". It is not a judgement about any particular CA beyond trust-store membership.

• https_available Circular-derived · mandatory

  A certificate-validated HTTPS connection can be established on port 443.

• http_behavior HTTPS-only interpretation · mandatory

  Plain HTTP on port 80 either redirects to HTTPS or is unavailable. It must not serve website content over plaintext. A cross-host redirect is reported as needing separate coverage.

• modern_tls Circular-derived · mandatory

  TLS 1.2 or TLS 1.3 is accepted. Either one is enough; both are not required.

• legacy_protocols Circular-derived · mandatory

  SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are not accepted. A protocol our scanner cannot probe is reported as unknown, never as rejected.

• expiry_warning Advisory (our operational threshold, not a government rule)

  Warn when the leaf certificate expires within the threshold. The circular sets no number of days; this threshold is our own operational choice.

Limitations

• Results describe the tested endpoint at scan time only.
• An unreachable endpoint, timeout or scanner limitation is reported as unknown, never as a pass.
• Renewal procedures and overall website security need separate review.
• Every check is public: recent checks (website name and result) are listed on the homepage and link to their reports. Reports are not indexed by search engines and are deleted after 90 days.