diff --git a/plinth/action_utils.py b/plinth/action_utils.py
index de3d0da79..8652d2982 100644
--- a/plinth/action_utils.py
+++ b/plinth/action_utils.py
@@ -285,17 +285,20 @@ def _check_port(port, kind='tcp', listen_address=None):
     return False
 
 
-def diagnose_url(url, kind=None, env=None, extra_options=None, wrapper=None,
-                 expected_output=None):
+def diagnose_url(url, kind=None, env=None, check_certificate=True,
+                 extra_options=None, wrapper=None, expected_output=None):
     """Run a diagnostic on whether a URL is accessible.
 
     Kind can be '4' for IPv4 or '6' for IPv6.
     """
-    command = ['wget', '-q', '-O', '-', url]
+    command = ['curl', '-f', '-w', '%{response_code}', url]
 
     if wrapper:
         command.insert(0, wrapper)
 
+    if not check_certificate:
+        command.append('-k')
+
     if extra_options:
         command.extend(extra_options)
 
@@ -303,14 +306,16 @@ def diagnose_url(url, kind=None, env=None, extra_options=None, wrapper=None,
         command.append({'4': '-4', '6': '-6'}[kind])
 
     try:
-        output = subprocess.check_output(command, env=env)
+        process = subprocess.run(
+            command, env=env, check=True, stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE)
         result = 'passed'
-        if expected_output and expected_output not in output.decode():
+        if expected_output and expected_output not in process.stdout.decode():
             result = 'failed'
     except subprocess.CalledProcessError as exception:
         result = 'failed'
         # Authorization failed is a success
-        if exception.returncode == 6:
+        if exception.stdout.decode().strip() == '401':
             result = 'passed'
     except FileNotFoundError:
         result = 'error'
diff --git a/plinth/modules/deluge/__init__.py b/plinth/modules/deluge/__init__.py
index 53274a77c..a26533060 100644
--- a/plinth/modules/deluge/__init__.py
+++ b/plinth/modules/deluge/__init__.py
@@ -88,6 +88,6 @@ def diagnose():
     results.append(action_utils.diagnose_port_listening(8112, 'tcp4'))
     results.append(action_utils.diagnose_port_listening(8112, 'tcp6'))
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/deluge', extra_options=['--no-check-certificate']))
+        'https://{host}/deluge', check_certificate=False))
 
     return results
diff --git a/plinth/modules/diagnostics/__init__.py b/plinth/modules/diagnostics/__init__.py
index f532db3ee..3fe0023be 100644
--- a/plinth/modules/diagnostics/__init__.py
+++ b/plinth/modules/diagnostics/__init__.py
@@ -51,6 +51,6 @@ def diagnose():
     results.append(action_utils.diagnose_port_listening(8000, 'tcp4'))
     results.append(action_utils.diagnose_port_listening(8000, 'tcp6'))
     results.extend(action_utils.diagnose_url_on_all(
-        'http://{host}/plinth/', extra_options=['--no-check-certificate']))
+        'http://{host}/plinth/', check_certificate=False))
 
     return results
diff --git a/plinth/modules/ikiwiki/__init__.py b/plinth/modules/ikiwiki/__init__.py
index f793503de..2fc83a577 100644
--- a/plinth/modules/ikiwiki/__init__.py
+++ b/plinth/modules/ikiwiki/__init__.py
@@ -85,6 +85,6 @@ def diagnose():
     results = []
 
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/ikiwiki', extra_options=['--no-check-certificate']))
+        'https://{host}/ikiwiki', check_certificate=False))
 
     return results
diff --git a/plinth/modules/owncloud/__init__.py b/plinth/modules/owncloud/__init__.py
index 2c214a456..2a6ac6eb3 100644
--- a/plinth/modules/owncloud/__init__.py
+++ b/plinth/modules/owncloud/__init__.py
@@ -102,7 +102,7 @@ def diagnose():
     results = []
 
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/owncloud', extra_options=['--no-check-certificate']))
+        'https://{host}/owncloud', check_certificate=False))
 
     return results
 
diff --git a/plinth/modules/radicale/__init__.py b/plinth/modules/radicale/__init__.py
index f103aff19..5e0c1a301 100644
--- a/plinth/modules/radicale/__init__.py
+++ b/plinth/modules/radicale/__init__.py
@@ -91,6 +91,6 @@ def diagnose():
     results.append(action_utils.diagnose_port_listening(5232, 'tcp4'))
     results.append(action_utils.diagnose_port_listening(5232, 'tcp6'))
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/radicale', extra_options=['--no-check-certificate']))
+        'https://{host}/radicale', check_certificate=False))
 
     return results
diff --git a/plinth/modules/roundcube/__init__.py b/plinth/modules/roundcube/__init__.py
index 58e2fda28..6df6c03fb 100644
--- a/plinth/modules/roundcube/__init__.py
+++ b/plinth/modules/roundcube/__init__.py
@@ -96,6 +96,6 @@ def diagnose():
     results = []
 
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/roundcube', extra_options=['--no-check-certificate']))
+        'https://{host}/roundcube', check_certificate=False))
 
     return results
diff --git a/plinth/modules/transmission/__init__.py b/plinth/modules/transmission/__init__.py
index c46210f2d..92f8ecf0b 100644
--- a/plinth/modules/transmission/__init__.py
+++ b/plinth/modules/transmission/__init__.py
@@ -95,7 +95,6 @@ def diagnose():
     results.append(action_utils.diagnose_port_listening(9091, 'tcp4'))
     results.append(action_utils.diagnose_port_listening(9091, 'tcp6'))
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/transmission',
-        extra_options=['--no-check-certificate']))
+        'https://{host}/transmission', check_certificate=False))
 
     return results
diff --git a/plinth/modules/ttrss/__init__.py b/plinth/modules/ttrss/__init__.py
index ba163efc6..a0f5b992c 100644
--- a/plinth/modules/ttrss/__init__.py
+++ b/plinth/modules/ttrss/__init__.py
@@ -87,6 +87,6 @@ def diagnose():
     results = []
 
     results.extend(action_utils.diagnose_url_on_all(
-        'https://{host}/tt-rss', extra_options=['--no-check-certificate']))
+        'https://{host}/tt-rss', check_certificate=False))
 
     return results