questionnaire asks whether our website uses SSL or TLS, how do I check that

SSL or TLS on the website is a matter of checking, not certifying

Yes, in practice this should simply be in order: a public website should establish a connection via TLS (the successor to SSL, but the term SSL is still often used in questionnaires for the same thing). Checking can be done without fuss: see if the address starts with "https" and if the browser shows a padlock in the address bar. Click on that padlock for the certificate details — issuer, validity date. That is sufficient as evidence for yourself; the customer rarely asks for the certificate itself to be uploaded, usually confirmation with yes is enough.

If you doubt whether the answer "yes" should be given — for example because part of the site still runs via http, or because an old certificate has expired — do not answer yes for the entire company if it only applies to part of it. This is one question within a larger block about access and encryption; policy on cryptography and encryption is often asked in the same questionnaire and goes beyond the website alone. If you have recorded nothing about this, then that is a gap that is separate from this single yes answer.

Why this is asked together with access policy in questionnaires

TLS on the website is one of the ten measures from Article 21 paragraph 2 of the NIS2 Directive (Directive (EU) 2022/2555), in particular the part on cryptography and encryption, and recurs in the control measures of Annex A of ISO/IEC 27001. Customers who ask this are therefore not just testing a technical detail: they are checking whether the access policy including management of business assets is in order, of which encryption is a fixed component. For the Dutch market, this will become the implementation of that same directive through the Cybersecurity Act, with entry into force on 15 August 2026 — but the question in questionnaires is already ahead of this, because customers want to cover their own chain obligations now.