SaQura instant check · free, no account
How does your server serve its certificate? Checked from the outside within seconds.
Enter the hostname. You see the grade from A to F with its reasons, the expiry date, the negotiated protocol and whether your server already chooses a quantum-safe key exchange today.
The check covers exactly this one address on port 443, from the outside, the way a browser sees it. No email address needed.
Where to go from here
Every certificate of your domain, including forgotten subdomains
The certificate report searches the public certificate registers for every address of your domain and checks each one, with the same rules as this check.
See the certificate reportMonitor continuously
SaQura CertWatch checks your addresses continuously and speaks up before a certificate expires.
See SaQura CertWatchOn the go, SaQura CertWatch is available as a free iPhone app.View on the App Store
What the check looks at
Certificate
Expiry date, name, trust chain, revocation status, key and signature, and whether the server really sends the intermediate certificates.
Connection
The negotiated TLS protocol. Obsolete protocols (TLS 1.1 and older) lead to grade F, missing TLS 1.3 to grade B.
The same rules as the product
Grade and reasons come from the same code as in the certificate report and in SaQura CertWatch. The worst rule that applies sets the grade.
What the check does not tell you
The result is a snapshot of a single address on port 443. It says nothing about other subdomains, other ports or the application behind the server.
What happens to your input
The hostname goes to our checking service. It opens a few connections to that address on port 443 and asks the certificate's issuer for the revocation status. The result stays in memory for up to 10 minutes so that a repeat does not trigger a new measurement, and is then discarded. The hostname is neither logged nor written to a database. For rate limiting the service counts requests per IP address, also in memory only and for at most 24 hours. Our cookieless visit statistics receive the grade only, never the hostname.