Arostik Logo
ArostikVLARCK

Micro-Technology Solutions

Web Cryptographic Security

Auditor for SSL / TLS Certificates

Check the validity, issuer and trust chain of any domain's SSL certificate.

Recent audits

Your last audits will show up here, only in this browser.

SSL / TLS & X.509 Cryptographic Architecture

Asymmetric encryption, TLS 1.3 handshake, Certificate Authorities (CA), and HSTS.

TLS 1.3 Handshake & Asymmetric Crypto

TLS 1.3 optimizes handshakes to 1-RTT using ECDHE ephemeral key exchange (Curve25519/P-256) ensuring Perfect Forward Secrecy.

X.509 Chain of Trust (Leaf, Intermediate, Root)

Browsers validate root CAs embedded in OS keystores. The leaf server certificate is signed by an intermediate CA, terminating at the trusted root.

SAN (Subject Alternative Names) & SNI

SAN extensions enable multi-domain and wildcard certificates. SNI allows web servers to host hundreds of distinct HTTPS sites on a single shared IP address.

Strict Security: HSTS & Preload Lists

HSTS headers force HTTPS connections, thwarting SSLStrip downgrade attacks. Preloaded domains are strictly protected directly in browser source code.

SSL / TLS Certificate Troubleshooting & Fixes

Technical fixes for Nginx, Apache, Let's Encrypt Certbot, and Cloudflare SSL errors.

Issue 1

ERR_SSL_PROTOCOL_ERROR / Plain HTTP on 443

⚡ Quick Fix:Check if you are requesting HTTPS on a port only serving plain HTTP traffic.
🔧 Technical Fix:In Nginx config, verify `listen 443 ssl;` is set instead of plain `listen 443;`. Reload with `nginx -t && systemctl reload nginx`.
Issue 2

Expired Certificate (CERT_HAS_EXPIRED / Let's Encrypt Drop)

⚡ Quick Fix:If behind Cloudflare proxy, toggle Edge Certificate Universal SSL for immediate coverage.
🔧 Technical Fix:Execute `certbot renew --force-renewal` and verify systemd timer `systemctl status certbot.timer` is enabled.
Issue 3

Domain Mismatch (CERT_COMMON_NAME_INVALID / Missing SAN)

⚡ Quick Fix:Configure a 301 redirect between www and apex domain if cert only covers one variant.
🔧 Technical Fix:Re-issue certificate covering all hostnames with `certbot --nginx -d domain.com -d www.domain.com -d api.domain.com`.
Issue 4

Incomplete Chain (UNABLE_TO_VERIFY_LEAF_SIGNATURE / Missing Intermediates)

⚡ Quick Fix:Check if failure happens mostly on mobile devices lacking intermediate CA caches.
🔧 Technical Fix:In Nginx set `ssl_certificate` to `fullchain.pem` (cert + intermediate bundle) instead of `cert.pem` alone.

Did You Know? SSL / TLS Trivia

Historical trivia about Netscape SSL, Microsoft's $35 slip-up, and Post-Quantum cryptography.

📜

SSL 1.0 Was Never Released to the Public

Developed at Netscape by Taher Elgamal, SSL 1.0 had serious replay flaws and was never published. The web first met SSL 2.0 in 1995 with Netscape Navigator 1.1.

🚀

Let's Encrypt: Over 400 Million Active Free Certificates

Prior to 2015, SSL certs cost $50-$300/yr with manual fax checks. Let's Encrypt's ACME protocol drove global HTTPS adoption from 38% to over 95% today.

💸

When a User Paid $35 to Save Microsoft Hotmail in 1999

On Christmas 1999, Hotmail went down globally because Microsoft forgot to renew `passport.com`. A Linux consultant named Michael Lawrie paid the $35 renewal fee with his own credit card to restore it.

⚛️

Post-Quantum TLS (Kyber / ML-KEM) Is Already Here

To defend against 'Harvest Now, Decrypt Later' attacks, Cloudflare and Chromium browsers now negotiate hybrid X25519Kyber768 lattice-based post-quantum cryptography.