Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
The server completed a TLS 1.0 handshake. TLS 1.0 (1999) was formally deprecated by RFC 8996 in 2021, lacks modern AEAD ciphers and downgrades every client that can be tricked into it. Some large operators keep it on deliberately for legacy clients, so this caps the grade at C rather than failing it outright — but the fix is the same: disable TLS 1.0 and 1.1 at the server or load balancer.
A modern client settling below TLS 1.3 means the server does not offer it. TLS 1.2 with a sound cipher is not broken, but 1.3 removes whole classes of handshake problems and is faster — enable it.
RSA-2048 (≈112-bit classical security) is still fine today. At the same security level, ECDSA P-256 or Ed25519 keys and signatures are several times smaller and the handshake cheaper — worth considering at the next renewal.
RSA-2048 is a sound choice today. It is, however, quantum-vulnerable: NIST IR 8547 (draft) plans to disallow classical signature algorithms — ECDSA, EdDSA and RSA — after 2035, and this key sits at the 112-bit security level that the same draft deprecates one step earlier, after 2030. No penalty and no emergency — but certificate rotation is the easy part; knowing everywhere else your systems sign is the real migration work.
Valid until 2027-02-10 — 106 days remaining.
Every issuer → subject link matches; the root itself is omitted, which is normal (chain as served).
The badge is an SVG served by ecdsa.com and re-checked hourly, so it follows your configuration on its own. Four more — expiry countdown, TLS version, certificate key and post-quantum readiness — plus styles and custom labels live on the badge builder.
Free email alerts 30, 14, 7, 3 and 1 days before this domain's certificate expires. Double opt-in: nothing is sent until you confirm, and every email carries an unsubscribe link. Your address is stored for this purpose only.
How we handle your address: Privacy Policy.
Paste any PEM or DER and decode it locally, field by field.
Why the modern-key findings read the way they do.
What actually lives inside those certificate signatures.
This check runs from our server: the domain name in the URL is sent to ecdsa.com and we connect to that domain's port 443. Nothing else is collected. The chain is assessed exactly as served — this report describes the configuration and does not perform full path validation against any browser trust store.