Is your TLS key really yours? Free TLS key audit

CryptoAudit is a free audit for any X.509 certificate, public key or domain. We screen what you submit against more than 60 million live public certificates and run 16 cryptographic checks across four detector families in seconds. Nothing you submit for analysis is stored, and there are no third-party trackers on this page.

How it works

Every submission runs through the same battery of passive, public-key checks. No private key is ever required or kept.

• Shared RSA factors (batch GCD). Using Bernstein batch GCD, your modulus is compared against the whole corpus in one pass to find a shared prime factor, which would make the private key trivially recoverable.
• Close primes (Fermat). Fermat factorisation detects RSA moduli whose two primes are too close together, a sign of broken key generation.
• ROCA (CVE-2017-15361). Detects the Infineon key generation fingerprint that makes affected RSA keys far easier to factor.
• Weak parameters. Flags undersized keys, bad public exponents, perfect powers, small factors, Debian weak keys and keys vulnerable to Wiener's attack, against CNSA 2.0 and NIST guidance.
• Reused keys. Finds the same public key or modulus shared across multiple certificates, a common symptom of cloned firmware or copied private keys.

The reference set spans 60M+ public certificates, built from Certificate Transparency logs, the crt.sh replica, public scan datasets and polite TLS sampling.

Frequently asked questions

What is a shared RSA factor?

Two RSA keys share a factor when their moduli have a common prime, usually because a device generated keys with a faulty random number generator. Anyone can then recover both private keys with a single gcd computation. CryptoAudit screens your modulus against 60M+ public keys using batch GCD to detect exactly this.

What is ROCA?

ROCA (CVE-2017-15361) is a flaw in the RSA key generation of Infineon TPM and smartcard libraries. Affected keys carry a recognisable fingerprint and can be factored far faster than a sound key of the same size. CryptoAudit detects that fingerprint on any RSA key you submit.

Is my data stored?

No. Certificates, public keys and domains you submit are analysed in memory and never stored. We keep no private keys, and there are no third-party trackers, advertising pixels or analytics cookies on this site. Privacy by design.

How often is the dataset updated?

The reference corpus is built from Certificate Transparency logs, the crt.sh replica, public scan datasets and polite TLS sampling. We refresh it in batches, and the public statistics on this page reflect the current snapshot.

What should I do if my key is weak?

Treat the private key as compromised. Generate a fresh key on a system with a sound random number generator, reissue the certificate and revoke the old one. If the weakness affects a device fleet, rotate every certificate that shares the same firmware or key source.

Is this tool free?

Yes. CryptoAudit is free, with no account required and no data retained. It is published by ZETACERT TECHNOLOGIES as a public service.