TLS Certificate Inspection

Every HTTPS server presents a TLS certificate to any connecting client. That certificate contains the subject name, the issuer (the CA that signed it), the validity period, the public key algorithm, the key length, the SAN (Subject Alternative Names — additional domains), and a fingerprint. QROS reads this certificate and reports it in a structured, searchable format.

What QROS reads from each TLS certificate

• Subject — the CN (Common Name) and organization the cert is issued to
• Issuer — the CA that signed the certificate (Let's Encrypt, DigiCert, self-signed)
• SAN — Subject Alternative Names: additional domains covered by the cert
• Validity — not before / not after dates; flags expired certificates
• Algorithm — RSA, ECDSA (P-256, P-384, P-521), Ed25519; flags weak algorithms
• Key length — RSA-1024 (broken), RSA-2048 (quantum-vulnerable), ECC-P256 (quantum-vulnerable)
• Fingerprint — SHA-256 fingerprint for cert identification

Spot weak and quantum-vulnerable keys

QROS flags certificates with weak key lengths (RSA-1024 = broken today, RSA-2048 = broken by quantum) and weak algorithms (SHA-1, 3DES, RC4). For each certificate, QROS reports the quantum risk: RSA and ECC keys are Shor-vulnerable (fully broken by a sufficiently large quantum computer), while AES keys are Grover-halved (quadratic speedup but still secure at 256 bits).

Search TLS certificates by algorithm or issuer

QROS lets you search the indexed host database by certificate properties — all hosts with TLS certificates, filter by algorithm, key length, issuer, or expiry date. Find every self-signed cert, every expired cert, every RSA-1024 cert in seconds.

What a TLS certificate looks like in QROS

When QROS reads a TLS certificate from a host, it shows the full details in the host dossier — including a quantum risk assessment of the key: