¿Qué necesito para auditar un certificado SSL?

Solo el dominio (ejemplo.com), la URL completa[](https://ejemplo.com) o una IP pública que escuche en el puerto 443. La herramienta se conecta por TLS y extrae el certificado en tiempo real.

¿Qué significan los colores del medidor de vigencia?

Verde: más de 30 días restantes. Amarillo: 30 días o menos. Rojo: certificado expirado o inválido (o no se pudo establecer la conexión TLS de forma segura).

¿Arostik guarda los dominios o certificados que consulto?

No. La consulta se realiza en el momento contra el servidor destino y el resultado se muestra solo en tu navegador. El historial de auditorías se guarda únicamente en localStorage de tu dispositivo.

¿La herramienta valida que el certificado coincida con el dominio?

Sí. Además de extraer los datos del certificado, comprobamos si el nombre del host coincide con el Subject o los Subject Alternative Names (SAN), y si la cadena es de confianza según Node.js.

WEB CRYPTOGRAPHIC SECURITY

Auditor for SSL / TLS Certificates

Check the validity, issuer and trust chain of any domain's SSL certificate.

Recent audits

Your last audits will show up here, only in this browser.

SSL / TLS & X.509 Cryptographic Architecture

Asymmetric encryption, TLS 1.3 handshake, Certificate Authorities (CA), and HSTS.

TLS 1.3 Handshake & Asymmetric Crypto

TLS 1.3 optimizes handshakes to 1-RTT using ECDHE ephemeral key exchange (Curve25519/P-256) ensuring Perfect Forward Secrecy.

X.509 Chain of Trust (Leaf, Intermediate, Root)

Browsers validate root CAs embedded in OS keystores. The leaf server certificate is signed by an intermediate CA, terminating at the trusted root.

SAN (Subject Alternative Names) & SNI

SAN extensions enable multi-domain and wildcard certificates. SNI allows web servers to host hundreds of distinct HTTPS sites on a single shared IP address.

Strict Security: HSTS & Preload Lists

HSTS headers force HTTPS connections, thwarting SSLStrip downgrade attacks. Preloaded domains are strictly protected directly in browser source code.

SSL / TLS Certificate Troubleshooting & Fixes

Technical fixes for Nginx, Apache, Let's Encrypt Certbot, and Cloudflare SSL errors.

Issue 1

ERR_SSL_PROTOCOL_ERROR / Plain HTTP on 443

⚡ Quick Fix:Check if you are requesting HTTPS on a port only serving plain HTTP traffic.

🔧 Technical Fix:In Nginx config, verify `listen 443 ssl;` is set instead of plain `listen 443;`. Reload with `nginx -t && systemctl reload nginx`.

Issue 2

Expired Certificate (CERT_HAS_EXPIRED / Let's Encrypt Drop)

⚡ Quick Fix:If behind Cloudflare proxy, toggle Edge Certificate Universal SSL for immediate coverage.

🔧 Technical Fix:Execute `certbot renew --force-renewal` and verify systemd timer `systemctl status certbot.timer` is enabled.

Issue 3

Domain Mismatch (CERT_COMMON_NAME_INVALID / Missing SAN)

⚡ Quick Fix:Configure a 301 redirect between www and apex domain if cert only covers one variant.

🔧 Technical Fix:Re-issue certificate covering all hostnames with `certbot --nginx -d domain.com -d www.domain.com -d api.domain.com`.

Issue 4

Incomplete Chain (UNABLE_TO_VERIFY_LEAF_SIGNATURE / Missing Intermediates)

⚡ Quick Fix:Check if failure happens mostly on mobile devices lacking intermediate CA caches.

🔧 Technical Fix:In Nginx set `ssl_certificate` to `fullchain.pem` (cert + intermediate bundle) instead of `cert.pem` alone.

Did You Know? SSL / TLS Trivia

Historical trivia about Netscape SSL, Microsoft's $35 slip-up, and Post-Quantum cryptography.

📜

SSL 1.0 Was Never Released to the Public

Developed at Netscape by Taher Elgamal, SSL 1.0 had serious replay flaws and was never published. The web first met SSL 2.0 in 1995 with Netscape Navigator 1.1.

🚀

Let's Encrypt: Over 400 Million Active Free Certificates

Prior to 2015, SSL certs cost $50-$300/yr with manual fax checks. Let's Encrypt's ACME protocol drove global HTTPS adoption from 38% to over 95% today.

💸

When a User Paid $35 to Save Microsoft Hotmail in 1999

On Christmas 1999, Hotmail went down globally because Microsoft forgot to renew `passport.com`. A Linux consultant named Michael Lawrie paid the $35 renewal fee with his own credit card to restore it.

⚛️

Post-Quantum TLS (Kyber / ML-KEM) Is Already Here

To defend against 'Harvest Now, Decrypt Later' attacks, Cloudflare and Chromium browsers now negotiate hybrid X25519Kyber768 lattice-based post-quantum cryptography.

SSL Certificates, TLS Encryption & PKI Glossary

Learn the fundamental concepts, protocols, and technical terminology of this tool.

Certificado SSL/TLSSeguridad

What is an SSL/TLS certificate?

A cryptographic credential pairing a public key with a domain identity, facilitating HTTPS encrypted transport and verifying host authenticity.

Cadena de Confianza (Trust Chain)PKI

What is an SSL certificate trust chain?

The hierarchical validation chain linking an end-entity domain certificate through intermediate issuers up to a trusted pre-installed Root CA store.

Protocolo TLS 1.3Criptografía

Why is TLS 1.3 superior to older protocols?

Deprecates legacy vulnerable ciphers, accelerates session handshakes to a single round-trip (1-RTT), and encrypts key exchange metadata.

Cabecera HSTSCabeceras

What is HTTP Strict Transport Security (HSTS)?

A response header commanding browsers to communicate exclusively over encrypted HTTPS, thwarting SSL stripping and man-in-the-middle attacks.