Key analysis describes the public keys and algorithms in observed certificates. It helps identify small keys, older profiles, and deployments that present only RSA certificates.
Strength labels
For RSA, SSLBoard labels keys of at least 2048 bits Recommended, 1536–2047 bits Legacy, and smaller keys Too Small. For the elliptic-curve size classification, at least 256 bits is Recommended and 224–255 bits is Legacy, with smaller values Too Small. DSA uses the same size bands as RSA in this classifier. Ed25519, Ed448, and EdDSA are classified as Recommended by algorithm. For other algorithms with a reported size, the fallback bands are Recommended at 2048 bits or more, Legacy at 256–2047 bits, and Too Small below 256. Those fallback bands are not a comparison of equivalent security across algorithms, so keep the displayed algorithm and curve with the size.
Unknown means the available metadata does not support a usable classification. It does not mean the key has been proven weak. The labels are SSLBoard’s classification, and do not replace your organization’s approved algorithm and curve requirements.
RSA-only hosts
An RSA-only result means no elliptic-curve certificate was observed for the host in the assessed certificate data. It is an algorithm-diversity and deployment-readiness observation, not proof that its current certificate is broken.
A server can use an RSA certificate and still negotiate forward-secret key exchange. Conversely, an elliptic-curve certificate does not establish post-quantum protection. See forward secrecy and post-quantum readiness.
Review and verify
For small or legacy keys, review replacement options with the certificate issuer and the service operator. If adding an elliptic-curve certificate, confirm that your TLS terminator and intended clients support the deployment you choose.
After deploying a replacement, retest the affected addresses and check the certificate key profile actually observed. Merely generating a new key does not change the certificate a live endpoint serves.