Key Strength Findings

A certificate carries the server's public key. The check makes sure the key's algorithm and size are strong enough for current clients.

To confirm any fix on this page, install the reissued certificate and click Check Now on the monitor's page. openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text | grep "Public-Key" shows the served certificate's key size.

CERT_KEY01: Certificate key too short

Key: CERT_KEY01 · Label: Weak Key Algorithm · Severity: Error · Can be dismissed: No

What it means: the certificate's key is too short, such as an RSA key under 2048 bits.

Why it matters: short keys can be broken, and current clients and CAs refuse them.

How to fix it: generate a new key (RSA 2048 bits or more, or ECDSA P-256) and reissue the certificate with it. For example, openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr creates a new key and a signing request for your CA.

CERT_KEY02: Legacy key algorithm

Key: CERT_KEY02 · Label: Legacy Key Algorithm · Severity: Error · Can be dismissed: No

What it means: the certificate uses a legacy key algorithm, such as DSA, that modern clients may not support.

Why it matters: clients that don't support the algorithm can't connect.

How to fix it: generate a new RSA or ECDSA key and reissue the certificate with it.