Certificate uses a key that is too small

HighConfirmedtls.certificate.weak-key

What this check looks for

The certificate's key is smaller than the current minimum, so the encryption protecting the site is weaker than it should be.

Why it matters

An undersized key is the one part of TLS that gets weaker over time without anyone touching it. Browsers already reject 1024-bit RSA, and compliance regimes like PCI DSS fail an audit on it.

When the check passes, your report says: “The certificate's key meets the current minimum size”.

What it costs your score

When this check fails it removes 25 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity: high
Default confidence: confirmed
Status when triggered: fail
Deduction: 25 points
Family cap: tls.certificate · 60
Category: TLS
Module: Tls certificate
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Re-key the certificate with RSA 2048 or an EC P-256 key.

The key is below the minimum every browser and every audit regime accepts.

Generate a new key at the right size — do not reuse the old one.
Issue a new certificate for it and install both.
Prefer EC P-256: same strength, smaller handshakes, faster on mobile.

How to confirm it worked

openssl s_client -connect ‹host›:443 -servername ‹host› </dev/null 2>/dev/null | openssl x509 -noout -text | grep 'Public-Key'

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx

certbot --nginx -d ‹host› --key-type ecdsa --elliptic-curve secp256r1 --force-renewal

Apache

certbot --apache -d ‹host› --key-type ecdsa --elliptic-curve secp256r1 --force-renewal

Technical detail

The public key is ‹key algorithm› ‹key bits› bits; the minimum is ‹minimum bits›. NIST SP 800-57 places 2048-bit RSA and 256-bit elliptic curve at the same security level and treats anything below as legacy. An ECDSA P-256 key gives the same strength as RSA 3072 with much smaller handshakes, which is why it is the better default for a new certificate.