About CertH
What CertH scans, how grades are computed, where the leaderboard comes from — and what we never do.
CertH is a public health check for any domain's TLS/SSL setup: starting from a single standard handshake, it produces a 0–100 score with A+ to F grades, and tracks how that changes over time on a public leaderboard. No signup is needed to scan, and no server access is needed to keep monitoring.
How we scan
We only do what every TLS server already answers: send a ClientHello to port 443, read back the certificate chain and the negotiated protocol version plus cipher suite. No agent is installed, nobody logs into your server, no private key is ever touched, and page content is never crawled. To avoid being misled by one client fingerprint, several ClientHello variants are rotated and the most complete result is kept.
How the grade is computed
The score is weighted from the handshake result: lingering TLS 1.0/1.1 support, TLS 1.3 support, the strength of the negotiated cipher suite, certificate key and signature algorithm, remaining validity, hostname match and chain length. Following SSL Labs semantics, HSTS and OCSP stapling do not reduce the base score — they only decide whether A+ is reachable; an expired certificate scores 0 and F outright. Every deduction is listed with its reason so you can verify it line by line.
| Grade | Score | Meaning |
|---|---|---|
| A+ | ≥95 | ممتاز |
| A | ≥90 | جيد |
| B | ≥80 | يحتاج تحسينًا |
| C | ≥70 | ضعيف |
| D | ≥55 | ضعيف جدًا |
| F | <55 | راسب |
A+ additionally requires TLS 1.3 support and effective HSTS (max-age ≥ 180 days or preload); an expired certificate is graded 0 and F outright.
The leaderboard
The board is seeded from the Tranco Top 20,000 domains. A dedicated scan node re-probes them every day, writes the result into the snapshot history, and classifies each domain into 12 industries and 20 regions. Besides the overall ranking there are dynamic boards — biggest gains, expiring soon, newly indexed — plus per-grade sub-boards. All of them are public and require no login.
Badges & API
Any domain can produce an SVG badge — four styles: issuer card, 30-day trend card, frosted capsule and brand capsule — with light/dark themes and an optional score, edge-cached for one hour and ready to embed in a README, status page or dashboard. The public API offers instant scans, score history and leaderboard data without authentication.
Free, open, and where we stop
CertH is maintained by the CSR.plus team and runs on the Cloudflare free tier plus one self-operated scan node; public scanning, the leaderboard and the badges are free and require no account. The limit we are explicit about: CertH reports on transport-layer configuration. It is not a penetration test and not any compliance certification. Critical systems still deserve a full professional audit, and an A+ here is no reason to relax anywhere else.
