Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
The server completed a TLS 1.1 handshake. TLS 1.1 was deprecated together with 1.0 by RFC 8996; no mainstream client has needed it for years. Disable it — TLS 1.2 and 1.3 are the supported floor.
A modern client settling below TLS 1.3 means the server does not offer it. TLS 1.2 with a sound cipher is not broken, but 1.3 removes whole classes of handshake problems and is faster — enable it.
RSA-4096 is a sound choice today. It is, however, quantum-vulnerable: NIST IR 8547 (draft) plans to disallow classical signature algorithms — ECDSA, EdDSA and RSA — after 2035; at this key size there is no earlier 2030 milestone — that step covers only 112-bit parameter sets such as RSA-2048. No penalty and no emergency — but certificate rotation is the easy part; knowing everywhere else your systems sign is the real migration work.
RSA-4096 is a solid classical choice. ECDSA or Ed25519 would deliver the same security with far smaller keys and signatures, but there is nothing to fix here.
Valid until 2026-12-06 — 40 days remaining.
Lifetimes of 90 days or less are the signature of automated issuance and rotation (ACME et al.) — exactly the posture the shrinking CA/Browser Forum limits are pushing everyone toward. Well done.
Every issuer → subject link matches and the chain ends at a self-signed root (chain as served).
The badge is an SVG served by ecdsa.com and re-checked hourly, so it follows your configuration on its own. Four more — expiry countdown, TLS version, certificate key and post-quantum readiness — plus styles and custom labels live on the badge builder.
Free email alerts 30, 14, 7, 3 and 1 days before this domain's certificate expires. Double opt-in: nothing is sent until you confirm, and every email carries an unsubscribe link. Your address is stored for this purpose only.
How we handle your address: Privacy Policy.
Paste any PEM or DER and decode it locally, field by field.
Why the modern-key findings read the way they do.
What actually lives inside those certificate signatures.
This check runs from our server: the domain name in the URL is sent to ecdsa.com and we connect to that domain's port 443. Nothing else is collected. The chain is assessed exactly as served — this report describes the configuration and does not perform full path validation against any browser trust store.