SSL/TLS & Website
Certificate key and signature check
Whether your certificate uses a key and signature strong enough for today's browsers.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
We check the certificate's key and signature: an RSA key under 2048 bits, an elliptic-curve key on anything but P-256, P-384 or P-521, or a SHA-1 or MD5 signature anywhere in the chain is flagged. Our scanner reads this straight off your server, the way a browser does: every day for the domains DomainGuard watches on Starter and up, and whenever you press Scan now on a domain in your account. The quick one-off tools on this site cannot read a certificate, so they show whether HTTPS works but not this row.
Why it matters to your business
Weak keys and old signature algorithms are refused by modern browsers and flagged by security questionnaires from insurers and larger customers.
How to fix it
- Reissue the certificate with an RSA 2048-bit or larger key, or an ECDSA P-256 key, signed with SHA-256.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.