About

sslcheck.nakayumc.com is a free service for checking TLS certificates of internet-facing servers. With certificate lifetimes shrinking to 47 days by 2029, it helps you verify that renewals are actually deployed.

About the scanner

Connections are made only when a user submits a hostname or the API or a badge is requested. A quick check performs a single TLS handshake to each address the hostname resolves to (up to 8). No vulnerability probing or port scanning is performed.

Source reverse DNS: sslcheck.nakayumc.com
A configuration scan performs up to 160 TLS handshakes (up to ServerHello) against one address to enumerate protocols and cipher suites
Ports: 443, 8443, 465, 993, 995, 636, 25/587 (STARTTLS), 143 (STARTTLS), 110 (STARTTLS)
Non-public addresses (private, loopback, etc.) are never contacted

Opting out

If you operate a domain and do not want it to be checked, contact us with the domain name. The domain and its subdomains will be excluded.

Rating

Valid: at least one third of the lifetime remains
Renewal due: less than one third remains
Expiring very soon: less than 10% or 3 days remain
Inconsistent servers: addresses present different certificates or some cannot be reached
Invalid certificate: untrusted chain or hostname mismatch

Configuration grade

These rules are specific to this service. The lowest applicable cap wins.

Grade	Condition
F	Expired, untrusted or mismatched certificate; RSA key below 2048 bits; SHA-1 signature; SSL 3.0; RC4/DES/EXPORT/NULL/anonymous suites; no TLS 1.2 or later
C	TLS 1.0 or 1.1 enabled; 3DES/IDEA enabled
B	Suites without forward secrecy enabled; no AEAD suite
A	None of the above
A+	A, plus TLS 1.3 support and HSTS max-age of at least 180 days

The configuration scan runs against the first address the hostname resolves to.

The trust store is Ubuntu's ca-certificates (derived from the Mozilla CA Program).

Contact: contact@nakayumc.com