Key analysis describes the public keys and algorithms in the certificates your endpoints actually served. It is how you spot a small key, an ageing profile, or a deployment that has never issued anything but RSA.
The strength bands
| Algorithm | Recommended | Legacy | Too Small |
|---|---|---|---|
| RSA | 2048 bits and up | 1536 to 2047 | Below 1536 |
| DSA | 2048 bits and up | 1536 to 2047 | Below 1536 |
| Elliptic curve | 256 bits and up | 224 to 255 | Below 224 |
| Ed25519, Ed448, EdDSA | Always Recommended by algorithm | ||
| ML-DSA | Post-quantum signature algorithm | ||
| Anything else with a reported size | 2048 and up | 256 to 2047 | Below 256 |
That last fallback row is a size band, not a security equivalence. 256 bits of elliptic curve and 256 bits of RSA are nowhere near comparable, so always read the size together with the algorithm and curve shown beside it.
Unknown means the metadata did not support a classification. It is not a weakness finding. And these labels are SSLBoard’s, not a substitute for whatever algorithm and curve policy your organization has committed to.
RSA-only is a readiness signal, not a defect
An RSA-only host means every certificate seen for it in the assessed certificate data used RSA. Worth knowing, because ECDSA certificates are smaller and faster to verify, and algorithm diversity gives you somewhere to go. Other non-RSA algorithms such as Ed25519 and ML-DSA are not classified as RSA-only.
ML-DSA is a post-quantum certificate-signature algorithm. SSLBoard treats it as a distinct, recommended algorithm rather than legacy DSA. That protects certificate authentication; it does not replace the separate PQC key-exchange readiness check for the TLS session.
It is not a finding that anything is broken. Two things to keep straight:
- A server with an RSA certificate can and usually does negotiate forward-secret key exchange. See forward secrecy.
- An elliptic-curve certificate gives you nothing against a future quantum adversary. That is a separate question entirely. See post-quantum readiness.
Review and verify
For a small or legacy key, work through replacement with your issuer and whoever runs the service. If you are adding an elliptic-curve certificate alongside RSA, confirm your TLS terminator supports serving both and that your client base handles it.
Then retest the affected addresses and check the key profile that was actually observed. Generating a new key changes nothing until a live endpoint is serving the certificate built from it.