TLS & DNS
Generate a TLS configuration for your server, get ready for 47-day certificates, publish CAA, TLSA and security.txt records, follow the DNSSEC chain of trust, see whether your browser already uses post-quantum TLS and check many domains at once. Each page says exactly what, if anything, it sends over the network.
9 tools
TLS Config Generator
SSL configs for 28 servers
TLS settings for nginx, Apache, HAProxy, Caddy, Postfix, Node.js, Go, Java, .NET and 19 more servers from the TLSRef guidelines — the continuation of Mozilla’s — with post-quantum key exchange where your version supports it, and an explainer for the configuration you already run.
Open tool47-Day Certificate Calculator
Plan renewals for 200 → 100 → 47 days
Publicly trusted TLS certificates shrink from 398 to 200, 100 and finally 47 days by 2029. See what that means for your certificates: renewals and domain validations per year, the next deadlines and where your renewal policy breaks.
Open toolCAA Record Generator
Limit which CAs may issue
Generate CAA records (RFC 8659, RFC 8657) for any DNS host or panel — which CAs may issue certificates and wildcards, for which ACME account and validation method — and check what a CA sees in DNS today, with a verdict for every CA in the CCADB report.
Open toolTLSA Record Generator
DANE records from a certificate
Generate TLSA records for DANE (RFC 6698, RFC 7671) from a certificate, chain, public key or CSR — 3 1 1 by default, with key-rollover records — and check published records against the chain a server presents, with their DNSSEC status.
Open toolsecurity.txt Generator
Write and check security.txt
Write a security.txt file (RFC 9116) that tells researchers how to report vulnerabilities — contacts, expiry, encryption key, policy — or validate one you publish: every field, the expiry, the location and the OpenPGP signature framing.
Open toolDNSSEC Inspector
Trace the chain of trust
Follow the DNSSEC chain of trust from the IANA root trust anchors to any name and record type. Every DS digest, DNSKEY and RRSIG is verified in your browser with its own RSA, ECDSA and EdDSA code, and proofs of non-existence are explained.
Open toolPost-Quantum Browser Check
Does your browser use ML-KEM?
One click shows whether your browser negotiates the post-quantum hybrid X25519MLKEM768 with Cloudflare, over TLS on TCP and inside QUIC (HTTP/3), whether that is what its version should do, and what intercepting proxies or old versions change.
Open toolTLS Fingerprint (JA4)
See your browser’s JA4
Your browser’s JA4 fingerprint as ecdsa.com’s edge saw it, explained part by part — protocol, TLS version, cipher suites, extensions, ALPN — and a JA4 calculator for any fingerprint or ClientHello you paste.
Open toolBulk Domain Checker
TLS and expiry for a list of domains
Paste a list of domains and check them all through the ecdsa.com API: TLS grade, certificate expiry and key algorithm, TLS 1.3, legacy protocols and chain completeness for each, with a summary and CSV or JSON export.
Open tool