Are my certificates post-quantum?

Enter your domain. For each host we show the certificate's key and expiry, and whether anything needs attention now.

What this checks

Certificate key type and size, signature algorithm, issuer and expiry.
Expired, untrusted or mismatched certificates.

What it can't see

Certificates used behind your CDN or for internal services.
Post-quantum certificates aren't issued by public CAs for websites yet, so every host shows classical: that's expected today.

Questions

Should I worry that my certificates are classical?

Not today. The urgent step is post-quantum key exchange, which protects recorded traffic now. Certificate migration comes when browsers and public CAs support it.

What should I fix now?

Expired, untrusted or weak certificates (for example RSA under 2048 bits), which our checker flags.