Issued to
- Common name
- trusteed.io
- Organization
- —
- Subject alternative names
- trusteed.io
Overall: warning
Your certificate is valid — the configuration around it is not finished
The chain builds cleanly to a trusted root and the hostname matches, so browsers will connect without complaint. Three checks came back unconfirmed or unconfigured, and none of them can be proven safe from outside.
Certificate chain trustedLeaf CN trusteed.ioWorst severity · Medium
Failed
0Nothing is actively broken.
Warning
3Unconfirmed or unconfigured.
OK
7Verified good.
Skipped
1Out of scope for this scan.
Identity
The certificate itself
Issued by
- Common name
- YE1
- Organization
- Let's Encrypt (US)
- Validation type
- Domain Validated · free 90-day certificate
Crypto & revocation
- Public key
- EC 256-bit · signature sha384
- Key usage
- TLS Web Server Authentication
- Hostname match
- trusteed.io found in Subject Alternative Names
- OCSP / CRL
- No OCSP endpoint · CRL reachable
- Serial
- 5ed71c73de9f0b79ae032199
Needs attention
Three checks did not come back clean
None of them break TLS today — each one weakens it.
OCSP staplingUnable to confirm OCSP stapling — the server did not return a stapled revocation response during the handshake.
Why it matters
Without stapling, each client has to ask the CA whether your certificate is still valid. That adds latency on first connection, and if the CA responder is unreachable some clients hard-fail the connection while others silently skip revocation checking entirely.
What to do
Enable stapling at the terminating server or CDN and confirm it responds after a reload. Note that this certificate has no OCSP endpoint at all, so stapling only becomes possible if you move to an issuer that publishes one.
ssl_stapling on; ssl_stapling_verify on;HeartbleedUnable to confirm — no heartbeat response was received. This may mean a safe server, a disabled heartbeat, filtering or a timeout; a pass is not asserted.
Why it matters
A silent server and a patched server look identical from outside. We refuse to record an unverified check as passed, because a false all-clear on Heartbleed is worse than no answer at all.
What to do
Confirm locally which OpenSSL build the host runs. Anything at 1.0.1g or later, or any modern 3.x branch, is not affected — record that once and the check stops being ambiguous.
openssl version -aTLSA DNS recordNot configured — no TLSA record is published for this domain, so DANE validation is unavailable.
Why it matters
TLSA lets a client pin the expected certificate through DNSSEC, which defeats a mis-issued certificate from any other CA. It is optional for web traffic but increasingly expected for mail and for high-assurance APIs.
What to do
Publish a TLSA record for _443._tcp under a DNSSEC-signed zone, then rotate it as part of the renewal process — a stale TLSA record breaks connections harder than a missing one.
_443._tcp.trusteed.io. IN TLSA 3 1 1 <sha256>Show the 7 checks that are fine
CheckStatusDetail
Supported TLS protocolsOKOnly modern TLS protocols detected — no SSLv3, TLS 1.0 or 1.1 offered.
Cipher suitesOKNo suboptimal suites accepted. Every weak candidate we offered was rejected.
Force HTTPS (HSTS)OKHSTS header present with a positive max-age, and HTTP redirects to HTTPS.
Self-signed certificateOKCA-signed — the issuer differs from the subject, as it should.
SSL compressionOKDisabled, which is the correct setting (CRIME mitigation).
TLS fallback SCSVOKSupported, so downgrade attempts by a man-in-the-middle are detectable.
HPKP headersOKNot set — correct, since key pinning is deprecated and risky to operate.
Debian weak-key blacklistSkippedExcluded from this scan scope. Not a false positive — a capacity limit.
Path to a root
Certificate chain
Every link a client has to verify, from your server up to a root it already trusts.
- 1Server's certificatetrusteed.ioSignature OK
Issuer YE1Valid Aug 27, 2026 → Nov 25, 2026
- 2IntermediateYE1Signature OK
Issuer Root YEValid Sep 2, 2025 → Sep 2, 2028
- 3IntermediateRoot YESignature OK
Issuer ISRG Root X2Valid May 12, 2026 → Sep 2, 2032
- 4Root (trusted by clients)ISRG Root X2Signature OK
Issuer ISRG Root X1Valid May 12, 2026 → Sep 2, 2032
You have 86 days. Nobody will remind you on day 89.
Add trusteed.io to monitoring and we re-run these 11 checks weekly, alert on chain or protocol changes, and warn you 30, 14 and 3 days before expiry.
Results reflect one TLS handshake and one HTTP HEAD request from a single vantage point. Checks marked “unable to confirm” are not passes — a filtered probe and a patched server look identical from outside.