# HTTPS certificate warning incident worksheet

Incident owner: __________   First report time/time zone: __________
Exact affected URL and hostname: __________
Journey: [ ] event page [ ] registration [ ] checkout [ ] other __________
Browser warning and code (do not bypass): __________
Observed on device/network A: __________   Trusted comparison B: __________
Personal/payment data entry paused or alternate verified route: __________

| Clue | Observation and evidence | Responsible provider | Next action | Owner / due |
|---|---|---|---|---|
| Certificate validity dates and device clock | | | | |
| Requested hostname and covered names | | | | |
| Issuer and intermediate chain | | | | |
| CDN/edge, origin or third-party checkout boundary | | | | |
| Provider custom-domain or renewal status | | | | |

## Recovery gate
- [ ] Original URL opens without a warning in two trusted environments.
- [ ] The displayed hostname and intended event/checkout destination are correct.
- [ ] Registration and support owner have verified the attendee path.
- [ ] Each public hostname has certificate expiry/handshake monitoring and escalation.
- [ ] Evidence, resolution time and follow-up owner are recorded.

Resolution and evidence: __________   Approved to resume promotion by/date: __________