TLS certificate badges for your README

Five live SVG badges for any domain: the overall signature health grade, the certificate expiry countdown, the negotiated TLS version, the certificate key, and post-quantum readiness. Pick one, style it, copy the snippet — Markdown, HTML or reStructuredText. No account, no token, no build step.

DomainCustom label — optional, max 32 chars

Style

Try:

Pick a badge

Every preview below is the live endpoint rendering your domain right now.

Signature health gradesignature health | AThe overall A+ to F grade from the full report — chain, key, protocol and lifetime together./api/badge/yourdomain.comCertificate expirycert expires | in 34 daysDays left on the leaf certificate, turning amber inside 30 days and red inside a week./api/badge/yourdomain.com/expiryTLS versiontls | 1.3The protocol version a modern client actually negotiates with your server./api/badge/yourdomain.com/tlsCertificate keycert key | ECDSA P-256The public key your certificate certifies — ECDSA curve, RSA size, Ed25519 or ML-DSA./api/badge/yourdomain.com/keyPost-quantum readinesspost-quantum | not yetWhether the certificate already signs with a post-quantum algorithm. Classical reads “not yet”./api/badge/yourdomain.com/pqc

Copy it into your README

Enter a domain above and the snippets appear here.

All five badges

“Copy all as Markdown” uses each badge's own default label and the style selected above — five lines, ready to paste as a row.

Why put a badge there at all

It stays true on its own

The badge is an SVG rendered from a fresh scan and cached for an hour, not a snapshot you pasted once. Renew a certificate, switch to ECDSA, turn TLS 1.3 on — the badge follows within the hour, with no CI job and no token.

It is a check other people can repeat

Every badge links to the full report at ecdsa.com/health/<your domain>, so a reader can see exactly what was measured — chain, algorithms, protocol versions, lifetimes — instead of taking the colour on faith.

It catches the boring failure early

An expiry badge sliding into amber in your own README is a cheap, permanent reminder that the certificate needs renewing before it takes the site down at the weekend.

How the endpoints work

Each badge is a plain GET on https://ecdsa.com/api/badge/<domain> plus a type suffix — /expiry, /tls, /key, /pqc — and answers with an SVG. Two optional query parameters: ?style=for-the-badge for the tall uppercase variant and ?label=Your%20text to replace the left-hand caption.

Results are cached for an hour, so a busy README costs your server one handshake per hour, not one per visitor. A domain that cannot be reached renders a gray unreachable badge rather than a broken image — the badge never turns your README into a page of missing pictures.

Want the reasoning behind the grade first? Run the full check at Domain Signature Health, or read ECDSA vs RSA for why a key badge reads the way it does.