A CSR is signed by the private key corresponding to the public key in the CSR. This check verifies the signature on the CSR is valid. An invalid signature indicates that the CSR has been modified since it was created or the public key in the CSR doesn't correspond to the private key used to sign it.

This check checks if the CSR's name contains a field with no value. For example, the CSR Decoder would issue a warning about the name given below because the locality field is present, but has no value.

CN=www.acme.com, O=acme, L=, C=gb

The reason for this warning is that some CAs may reject CSRs that contain fields with empty values.

Checks for weak RSA keys generated by Debian-based systems. It uses the dowkd blacklist, which may be incomplete.

This page contains CSRs and certificates with known weak keys. Please let us know if it fails to identify a CSR or certificate you know to have weak key.

In May 2008, the Debian team announced that Luciano Bello had discovered a vulnerabilty in the Debian OpenSSL package. The impact was that all SSL and SSH keys generated on Debian-based systems (including Ubuntu) released between September 2006 and May 13th 2008 may be affected. The Debian Security Team disclosed this vulnerability in Debian Security Advisory 1571. The best resource on this vulnerability is the Debian Wiki. We have also written about this in our CSR FAQ.

Checks RSA and DSA keys are at least 2048 bits and EC keys are at least 224 bits

Bulk SSL Checker

Check Hundreds Of SSL Certificates With The Click Of A Button

We know that sometimes you may have many SSL sites to check and that checking lots of sites one at a time is tedious and long-winded. For this reason, we have created Bulk SSL Checker. Bulk SSL Checker checks the list of sites you upload and emails you the results so that you don't waste time checking sites one at a time.

Please note that we have also developed CertAlert, a windows based tool that can bulk check SSL certificates.

The Bulk SSL Checker reports are in HTML and CSV format. The CSV report provides in depth information about each certificate, and the HTML report categorises and summarises the findings (the report shown is of the Alexa top 5k websites has been anonymized.)

Below is a short video showing you how it works:

Bulk SSL Checker Features

Bulk SSL Checker has many features including:

Easy to use - just upload a list of hostnames to check and we'll do the rest
Emails reports directly to you in both CSV and HTML formats
The report highlights issues including:
- MD5 certificates
- Debian weak key certificates
- Expired certificates
- Certificates expiring in 90 days or less
- Untrusted certificates
- Issues with certificate key length
- Certificates that do not list the hostname they are associated with

How To Use Bulk SSL Checker

Log in ( If you don't have an account just create an account IT'S FREE)
Go to Bulk SSL Checker
Upload a file containing a list of hostnames to check.
Wait a short while (up to 40 minutes) for your results to be emailed to you

More about the file you upload

The file you upload is simply a list of the hostnames (or ip addresses) that you want checking on port 443. Below is an example of the file:

 facebook.com
 amazon.com
 yahoo.com
 72.21.210.250
 google.com

Try Our SSL Certificate Report Service

If you prefer, we can produce the SSL Certificate Audit Reports for you. We are able to run reports for most networks (small to large scale with millions of certificates). If you would like to try out this service, please contact us and we will send you a sample report free of charge.