PintellyPintelly

Persistent report

esinhoca.com SSL certificate report

Last analyzed:

Available again in 5:00

CN

esinhoca.com

Remaining

66d

Key

rsa 2048 bit

Signature

sha256WithRSAEncryption

TLS

TLSv1.3

Cipher

TLS_AES_256_GCM_SHA384

ALPN

h2

IP

195.244.34.199

Server

nginx

1

On

1.1

On

1.2

On

1.3

On

To-do, by priority

Fails first, then warnings. Tips are things this HTML fetch cannot see.

Error

TLS 1.0 / 1.1

SSL Labs caps the grade at B if either protocol is still accepted — even when modern clients negotiate 1.3. That is a server offer, not this handshake.

Warning

HSTS

Without Strict-Transport-Security a first visit can still go via HTTP.

HTTPSPass

HTTPS

+

Why it matters: Search and browsers treat HTTP as not secure.

Trusted certificatePass

Trusted

+

Why it matters: An untrusted chain is a browser warning, not a ranking bonus.

Name matches hostPass

esinhoca.com

+

Why it matters: The certificate must cover this hostname (CN or SAN), including wildcards.

ExpiryPass

66 days

+

Why it matters: An expired cert is an interstitial. Under 30 days is a calendar problem.

Self-signedPass

CA-signed

+

Why it matters: A leaf that signs itself is not trusted by browsers.

Certificate chainPass

4 certificates

+

Why it matters: The server must send intermediates. A missing WE1/GTS link is the usual 'works on my machine, fails on mobile' install bug.

Signature algorithmPass

sha256WithRSAEncryption

+

Why it matters: SHA-1 and MD5 signatures are rejected by current browsers.

Public keyPass

rsa · 2048 bit

+

Why it matters: RSA below 2048 bits, or a tiny curve, is too weak.

Negotiated protocolPass

TLSv1.3 · h2 · TLS_AES_256_GCM_SHA384

+

Why it matters: What this handshake actually spoke. A modern client will pick 1.2 or 1.3 when the server offers them.

TLS 1.0 / 1.1Error

1.0 yes · 1.1 yes · 1.2 yes · 1.3 yes

+

Why it matters: SSL Labs caps the grade at B if either protocol is still accepted — even when modern clients negotiate 1.3. That is a server offer, not this handshake.

1

What to do

Disable TLS 1.0 and 1.1 on the edge (Cloudflare: SSL/TLS → Edge Certificates → disable legacy, or the origin nginx/caddy config).

HSTSWarning

No HSTS

+

Why it matters: Without Strict-Transport-Security a first visit can still go via HTTP.

1

What to do

Send the HSTS header on HTTPS. Full scoring is on the security headers tool.

CAAInfo

No CAA

+

Why it matters: DNS CAA lists which CAs may issue for the domain. Optional, but Labs and CAs honour it.

IssuerInfo

Let's Encrypt / YR1

+

Why it matters: Who signed the leaf. Informational.

Certificate chain

The chain the server sent. The root (GlobalSign, etc.) lives in the client store and is often omitted.

Certificate #1

CN
esinhoca.com
Issuer
Let's Encrypt / YR1
Valid
Oct 4 09:59:43 2026 GMT → Jan 2 09:59:42 2027 GMT
Signature
sha256WithRSAEncryption
Key
rsa · 2048 bit
Serial
06DEB2572DE483235A502BD0B504B308C2B3
SHA-256
81:AE:D7:33:40:49:45:E8:F4:35:10:2D:9E:D8:34:0B:29:20:59:A3:DA:D4:A0:04:B5:40:0D:52:9E:C5:24:7F

Certificate #2

CN
YR1
Organization
Let's Encrypt
Issuer
ISRG / Root YR
Valid
Sep 3 00:00:00 2025 GMT → Sep 2 23:59:59 2028 GMT
Signature
sha256WithRSAEncryption
Key
rsa · 2048 bit
Serial
A20253F15F2691C05DC1CE13B9BCCA4E
SHA-256
13:94:96:34:D9:9C:D6:FD:6A:A8:0B:C0:34:FE:FA:CC:EB:19:69:FE:EF:98:65:86:71:3E:CD:BB:05:75:8D:3F

Certificate #3

CN
Root YR
Organization
ISRG
Issuer
Internet Security Research Group / ISRG Root X1
Valid
May 13 00:00:00 2026 GMT → Sep 2 23:59:59 2032 GMT
Signature
sha256WithRSAEncryption
Key
rsa · 4096 bit
Serial
F24B6D17F9D9AD7CB1C9FEA78782699F
SHA-256
07:26:39:D0:B1:40:D5:BF:FA:E1:6A:D9:C3:F6:CC:60:86:04:06:21:F5:1E:E6:1A:6D:46:A8:91:5C:07:CF:76

Certificate #4

CN
ISRG Root X1
Organization
Internet Security Research Group
Issuer
Internet Security Research Group / ISRG Root X1
Valid
Jun 4 11:04:38 2015 GMT → Jun 4 11:04:38 2035 GMT
Signature
sha256WithRSAEncryption
Key
rsa · 4096 bit
Serial
8210CFB0D240E3594463E0BB63828B00
SHA-256
96:BC:EC:06:26:49:76:F3:74:60:77:9A:CF:28:C5:A7:CF:E8:A3:C0:AA:E1:1A:8F:FC:EE:05:C0:BD:DF:08:C6

SAN

*.esinhoca.com, esinhoca.com

Get this report by email on a schedule, with what changed since last time.