Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
Connecting to port 443, reading the certificate chain, probing protocol versions…
Signature Health
RSA-2048 (≈112-bit classical security) is still fine today. At the same security level, ECDSA P-256 or Ed25519 keys and signatures are several times smaller and the handshake cheaper — worth considering at the next renewal.
RSA-2048 is a sound choice today. It is, however, quantum-vulnerable: NIST IR 8547 (draft) plans to disallow classical signature algorithms — ECDSA, EdDSA and RSA — after 2035, and this key sits at the 112-bit security level that the same draft deprecates one step earlier, after 2030. No penalty and no emergency — but certificate rotation is the easy part; knowing everywhere else your systems sign is the real migration work.
Valid until 2027-04-28 — 183 days remaining.
Handshakes capped at TLS 1.1 were rejected — the deprecated protocol versions are switched off.
The handshake settled on TLS 1.3 with TLS_AES_128_GCM_SHA256 — the current protocol generation, with a cleaner handshake and only AEAD ciphers.
Every issuer → subject link matches and the chain ends at a self-signed root (chain as served).
The badge is an SVG served by ecdsa.com and re-checked hourly, so it follows your configuration on its own. Four more — expiry countdown, TLS version, certificate key and post-quantum readiness — plus styles and custom labels live on the badge builder.
Free email alerts 30, 14, 7, 3 and 1 days before this domain's certificate expires. Double opt-in: nothing is sent until you confirm, and every email carries an unsubscribe link. Your address is stored for this purpose only.
How we handle your address: Privacy Policy.
Paste any PEM or DER and decode it locally, field by field.
Why the modern-key findings read the way they do.
What actually lives inside those certificate signatures.
This check runs from our server: the domain name in the URL is sent to ecdsa.com and we connect to that domain's port 443. Nothing else is collected. The chain is assessed exactly as served — this report describes the configuration and does not perform full path validation against any browser trust store.