Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
ECDSA P-256 is a sound choice today. It is, however, quantum-vulnerable: NIST IR 8547 (draft) plans to disallow classical signature algorithms — ECDSA, EdDSA and RSA — after 2035; at this key size there is no earlier 2030 milestone — that step covers only 112-bit parameter sets such as RSA-2048. No penalty and no emergency — but certificate rotation is the easy part; knowing everywhere else your systems sign is the real migration work.
ECDSA P-256 gives compact keys and signatures at full strength — the current best practice for TLS server certificates.
Valid until 2026-12-18 — 52 days remaining.
Lifetimes of 90 days or less are the signature of automated issuance and rotation (ACME et al.) — exactly the posture the shrinking CA/Browser Forum limits are pushing everyone toward. Well done.
Handshakes capped at TLS 1.1 were rejected — the deprecated protocol versions are switched off.
The handshake settled on TLS 1.3 with TLS_AES_256_GCM_SHA384 — the current protocol generation, with a cleaner handshake and only AEAD ciphers.
Every issuer → subject link matches; the root itself is omitted, which is normal (chain as served).
The badge is an SVG served by ecdsa.com and re-checked hourly, so it follows your configuration on its own. Four more — expiry countdown, TLS version, certificate key and post-quantum readiness — plus styles and custom labels live on the badge builder.
Free email alerts 30, 14, 7, 3 and 1 days before this domain's certificate expires. Double opt-in: nothing is sent until you confirm, and every email carries an unsubscribe link. Your address is stored for this purpose only.
How we handle your address: Privacy Policy.
Paste any PEM or DER and decode it locally, field by field.
Why the modern-key findings read the way they do.
What actually lives inside those certificate signatures.
This check runs from our server: the domain name in the URL is sent to ecdsa.com and we connect to that domain's port 443. Nothing else is collected. The chain is assessed exactly as served — this report describes the configuration and does not perform full path validation against any browser trust store.