Security

Data handling

• We store the domain you enter and the scan result: host names from public Certificate Transparency logs and the public certificate details each host presented.
• Reports are deleted automatically 30 days after the check. Each report is reachable only through its link, which contains a long random ID.
• We do not store your network address, in any form. The limit of 5 checks per hour is counted in the server's memory under a keyed hash of the address and forgotten within an hour; nothing about it is written to disk. Our logs do not contain IP addresses or email addresses.
• The check needs no account and no email address. See the Privacy policy for what we keep, for how long, and who processes it.
• We never ask for, access or store private keys, passwords or account access. The check only reads data that is already public.

Scanner behavior

• Host names come from public Certificate Transparency logs for the domain entered; at most 100 names are checked per scan.
• For each name the scanner opens one TLS connection to port 443 only, completes the handshake to read the certificate, and closes the connection. It sends no HTTP requests to your hosts, follows no redirects and tries no other ports.
• At most 10 hosts are checked in parallel, each with a 8-second limit. Names that resolve to private, loopback or other non-public addresses are skipped.
• HTTP requests the scanner makes, such as Certificate Transparency lookups, identify themselves with the user agent CertSteady/0.1.0 (+https://certsteady.com/security). TLS handshakes have no user agent field; they only send the host name being checked (SNI).
• Each network can start a limited number of checks per hour, so the service cannot be used to probe the same hosts repeatedly.

If you see scanner traffic you did not expect or want it to stop, contact us using the details in our security.txt file.

Reporting a vulnerability

If you believe you have found a security problem in CertSteady, please report it privately using the contact in /.well-known/security.txt. Include the steps to reproduce it and give us reasonable time to fix it before disclosing it. Please do not access other people's reports, degrade the service or test against hosts you do not control.