SSLBoard documentation

Type a domain, wait about a minute, and get an inventory of every public host SSLBoard could find and what each one is serving. No agent, no credentials.

Certificate Transparency logs suggest names, DNS resolves them, and live connections decide the facts. Knowing the source tells you how much to trust a row.

Why a live host can be missing, why a dead one keeps showing up, and the four things an external scan structurally cannot see.

The certificate on disk is new and the browser still sees the old one. Six places the stale certificate is hiding, in the order worth checking.

ERR_CERT_COMMON_NAME_INVALID means the certificate is valid, just not for the name you asked for. Five reasons that happens and how to read the SAN list.

Response headers pass through a chain and only the last writer wins. How to find which layer is dropping or overwriting Strict-Transport-Security.

Same hostname, two addresses, two machines. Why half your visitors can hit a broken certificate while every test you run says the site is fine.

Receiving mail and sending mail use different ports, different encryption, and fail independently. A closed submission port does not stop inbound delivery.

Enabling a new protocol version does not disable the old ones. Your server offers a list, and the client picks from it.

No. The certificate authenticates the server, the key exchange protects the session, and they are chosen independently. RSA key exchange is the thing to remove.

Usually because a shared hosting platform bundled you onto one certificate with other customers. Here is when that is normal and when it is worth a question.

Not entirely. NSEC3 raises the cost of walking your zone rather than preventing it, and the parameters most people pick make it worse. How to decide.

Hostnames, endpoints, and certificates count different things. Mixing them up is the fastest way to send the wrong ticket to the wrong team.

A check that could not run looks a lot like a check that passed. Here is how to tell the difference before you report a domain as clean.

Seven weighted categories, a penalty curve that cares about proportion as much as count, and a list of things the number deliberately ignores.

Renewing a certificate and deploying it are two different jobs, and only one of them shows up in your report. Here is how to tell which one you have done.

A CAA record tells certificate authorities who may issue for you. An empty wildcard column does not mean wildcards are banned, which trips up most people.

Supporting TLS 1.3 does not switch off TLS 1.0. Both can be reachable on the same endpoint, and an attacker gets to pick.

Stapling attaches a freshness proof to your handshake. Eight results are possible, and No response means something very different from Revoked.

Which cipher families SSLBoard flags and why, plus the reason family counts never add up to endpoint counts.

Forward secrecy decides whether traffic recorded today stays private if your key leaks in five years. Five classifications, and one of them is a trap.

What Recommended, Legacy, Too Small, Unknown, and RSA-only mean, and why a certificate key tells you nothing about key exchange.

Your HTTPS site can be flawless and still serve plain HTTP on port 80 to anyone who asks. That first unencrypted request is the finding.

HSTS is the one header with a delete key that is hard to reach. Get max-age, includeSubDomains, and preload right before you ship it, not after.

CSP, frame protection, nosniff, and eight cookie findings. All of them need your application's context before you tighten anything.

Six error categories, what each one narrows the problem down to, and why a failed connection is never evidence about your certificate.

Harvest now, decrypt later is the threat this addresses. Hybrid key exchange is available today, and the check tells you which endpoints already negotiate it.

Unsigned, broken, and enumerable are three different DNSSEC problems with three different responses. Bogus is the one that takes your domain offline.

Port 25 receives mail from the world, 465 and 587 take it from your users. They fail independently, and confusing them sends the wrong ticket.

Five published policies that decide whether anyone can send mail as you. Having a record and enforcing one are very different states.

Another company's domain in your report usually means you share a certificate with them. Worth knowing, and not the same as sharing an owner.

The full-report link carries its own access. Forwarding it forwards the access, so decide who needs the whole report before you paste it anywhere.

A good ticket names the endpoint, the owner, and what success looks like. Then you prove it with a scan that ran after the deployment, not before.