TLS signature-health grade for a domain

{
  "domain": "github.com",
  "grade": {
    "letter": "A+",
    "score": 100
  },
  "findings": [
    {
      "id": "pqc-migration-ahead",
      "severity": "info",
      "title": "Classical algorithm — post-quantum migration ahead",
      "detail": "ECDSA P-256 is a sound choice today. It is, however, quantum-vulnerable: NIST IR 8547 (draft) plans to disallow classical signature algorithms — ECDSA, EdDSA and RSA — after 2035; at this key size there is no earlier 2030 milestone — that step covers only 112-bit parameter sets such as RSA-2048. No penalty and no emergency — but certificate rotation is the easy part; knowing everywhere else your systems sign is the real migration work."
    },
    {
      "id": "key-modern",
      "severity": "ok",
      "title": "Modern signature key (ECDSA P-256)",
      "detail": "ECDSA P-256 gives compact keys and signatures at full strength — the current best practice for TLS server certificates."
    },
    {
      "id": "cert-valid",
      "severity": "ok",
      "title": "Within validity period",
      "detail": "Valid until 2026-11-29 — 41 days remaining."
    },
    {
      "id": "cert-short-lifetime",
      "severity": "ok",
      "title": "Short certificate lifetime (90 days)",
      "detail": "Lifetimes of 90 days or less are the signature of automated issuance and rotation (ACME et al.) — exactly the posture the shrinking CA/Browser Forum limits are pushing everyone toward. Well done."
    },
    {
      "id": "legacy-tls-refused",
      "severity": "ok",
      "title": "Legacy TLS refused",
      "detail": "Handshakes capped at TLS 1.1 were rejected — the deprecated protocol versions are switched off."
    },
    {
      "id": "tls13",
      "severity": "ok",
      "title": "TLS 1.3 negotiated",
      "detail": "The handshake settled on TLS 1.3 with TLS_AES_128_GCM_SHA256 — the current protocol generation, with a cleaner handshake and only AEAD ciphers."
    },
    {
      "id": "chain-complete",
      "severity": "ok",
      "title": "Certificate chain complete (as served)",
      "detail": "Every issuer → subject link matches and the chain ends at a self-signed root (chain as served)."
    }
  ],
  "scannedAt": "2026-10-20T07:14:02.839Z",
  "cached": true,
  "cacheTtlSeconds": 3600,
  "reportUrl": "https://ecdsa.com/health/github.com",
  "certificate": {
    "notAfter": "2026-11-29T23:59:59.000Z",
    "daysRemaining": 41,
    "keyAlgorithm": "ECDSA",
    "curve": "P-256"
  }
}