Illustrative example
SSL & TLS example report
Warningdemo.example
This is a permanent example with fictional data for demo.example. No scan runs when you open this page. Dates, timings and results are illustrative.
A verified TLS connection has 21 days left on its certificate at the example’s fixed reference time. One protocol probe and the CRL check remain unknown.
What to do next: Check renewal and deployment before expiry. Investigate unavailable protocol and revocation checks separately; a connection score does not answer them.
Trusted connection
TLS connection and hostname verified.
Expires: 17 Nov 2026 12:00:00 UTC · 21 days remaining
Basic connection score: 90 / 100
This score covers trust, hostname and expiry only. Protocol support, revocation, key strength and Certificate Transparency are reported separately below.
Certificate
- Common name
- demo.example
- Certificate type
- Domain Validation · Multi-domain
- Issuer
- Illustrative Certificate Authority · Example Intermediate CA
- Valid from
- 19 Aug 2026 12:00:00 UTC
- Valid until
- 17 Nov 2026 12:00:00 UTC
- Validity duration
- 90 days
- Signature algorithm
- sha256WithRSAEncryption
- Public key
- RSA · 2048 bits
- Serial number
- 01A2B3C4
- SHA-256 fingerprint
- 779b344296da1f642519ffa0f991b148c33340fb053fcaee2552103f1cf39525
Subject Alternative Names (SAN)
Total DNS / IP SAN count: 2
- DNS:demo.example
- DNS:www.demo.example
Connection
- Negotiated TLS version
- TLSv1.3
- Negotiated cipher
- TLS_AES_128_GCM_SHA256 · 128 bits
- Connected IP · port 443
- 192.0.2.10
- Duration
- 42.6 ms
Supported TLS versions
- TLSv1.3
- Supported
- TLSv1.2
- Supported
- TLSv1.1
- Rejected by server
- TLSv1.0
- Unknown / not checked
Each version is tested against the connected IP using separate handshakes. Timeouts and scanner limitations remain unknown. These probes do not verify certificate trust or enumerate every cipher.
DNS CAA
CAA records found at demo.example.
- 0 issue "ca.demo.example"
CAA discovery follows aliases and parent domains. Records describe issuance policy; issuer authorization and DNSSEC are not verified.
Certificate chain
2 certificates receivedCertificates sent by the server, in the order received. The root may be omitted by the server.
Received order: not verified.
The trusted path can end at a different certificate in the local trust store. A cross-signed CA and its self-signed root can share a name and key while having different issuers and expiry dates.
-
Server certificate
- Subject
- demo.example
- Issued by
- Example Intermediate CA
- Valid from
- 19 Aug 2026 12:00:00 UTC
- Valid until
- 17 Nov 2026 12:00:00 UTC
-
Intermediate / cross-signed CA
- Subject
- Example Intermediate CA
- Organization
- Illustrative Certificate Authority
- Issued by
- Example Root CA
- Valid from
- 27 Oct 2025 12:00:00 UTC
- Valid until
- 27 Oct 2027 12:00:00 UTC
Revocation / issuer URLs
- CA Issuers
https://demo.example/example-intermediate.crt
- OCSP
No URL available.
- CRL
http://demo.example/example-leaf.crl
Findings
Trusted connection
PassedPeer and hostname verification passed.
Verify the public endpoint with certificate checks enabled and review the received bundle and client trust store. Diagnostic details do not establish trust.
Hostname
PassedThe certificate was verified against the original hostname.
Compare the exact requested hostname with the certificate SAN entries before relying on an HTTPS redirect.
Validity period
WarningThe certificate expires within 30 days.
Compare the certificate served publicly with the renewed certificate file. Renewal and deployment are separate checks.
Chain trust
PassedThe chain is trusted. The certificate chain section shows only received certificates.
Verify the public endpoint with certificate checks enabled and review the received bundle and client trust store. Diagnostic details do not establish trust.
Negotiated protocol
InfoRead from the connection metadata of the verified handshake.
Review the negotiated version and the separate protocol probes. An unknown probe does not establish support or rejection.
Public key strength
PassedThe public key meets the baseline size: RSA 2048 bits or EC 256 bits.
Review the key and signature metadata against current provider and client requirements. This check is separate from the basic connection score.
Signature algorithm
PassedThe certificate uses a SHA-256, SHA-384 or SHA-512 signature algorithm.
Review the key and signature metadata against current provider and client requirements. This check is separate from the basic connection score.
OCSP / CRL revocation
Not checkedRevocation could not be verified. A trusted TLS handshake alone does not prove that the certificate has not been revoked. OCSP was not checked.
This measurement is incomplete. Use the explanation to check the outcome independently.
Read the method and scope of this measurement. An unavailable result or detected extension does not establish certificate compliance.
Certificate Transparency
Not checked2 embedded Signed Certificate Timestamps (SCTs) found. Log signatures, operators and browser CT policy were not verified.
This measurement is incomplete. Use the explanation to check the outcome independently.
SCT-related certificate data indicates transparency information was supplied. The scanner does not verify log inclusion or determine compliance with a browser’s CT policy.
How is the basic connection score calculated?
- Connection and trust50 / 50 points
- Hostname25 / 25 points
- Validity period15 / 25 points
Expiry within 30 days earns 15 of 25 validity points. Unknown checks prevent a total score. This is not a full TLS grade or a guarantee of website security. Ruleset: tls-v2.
About this scan
Checks certificate trust, hostname, validity and key details on port 443. New scans also probe TLS 1.0–1.3, discover CAA records and attempt server-certificate revocation verification via CRL, within 20 seconds. Unknown checks remain explicit. Does not verify CT compliance, OCSP or enumerate every cipher.
This fixed example is public and does not expire. It contains fictional data, not a stored visitor scan.
A snapshot, not a security guarantee.