This page is being served over plain HTTP — traffic is not encrypted and can be observed or modified in transit. Provision a TLS certificate and reload over HTTPS to see full connection and certificate details.
Your browser established a secure TLS session with this server. Every byte exchanged is encrypted, authenticated, and integrity-protected. The details below reflect your live connection.
This page is being served over HTTP. There is no TLS certificate to inspect. Provision a certificate via ACME and reload the page over HTTPS to see full certificate details here.
TLS Certificate Details
Your browser opened a TCP connection and sent a ClientHello advertising
supported TLS versions (1.3, 1.2), cipher suites, extensions, and a random nonce.
Modern browsers request TLS 1.3 first.
The server replied with its chosen cipher suite and sent its X.509 certificate chain — the end-entity cert, any intermediate CA certs, and optionally a stapled OCSP response.
An ECDH key exchange (P-256 or X25519) produced a shared secret that neither side
ever transmitted. This secret is ephemeral — discarded after the session — giving
perfect forward secrecy: future key compromise cannot decrypt past traffic.
Your browser verified the certificate chain against its trusted root store, checked the digital signature, confirmed the hostname matches the cert's CN / SANs, verified the certificate is not expired, and checked revocation status via OCSP.
Both sides derived symmetric session keys and exchanged Finished messages.
All subsequent HTTP traffic is encrypted with AES-256-GCM, authenticated
(AEAD), and integrity-protected. You are here now. ✓
ACME (RFC 8555) lets a server prove domain ownership to a CA and receive a signed certificate with zero manual steps — no CSR forms, no portal logins, no copy-paste.
The CA issued an HTTP-01 or DNS-01 challenge. The ACME client placed the required token at a well-known URL (or DNS record), and the CA verified control before issuing the cert.
The ACME client monitors expiry and re-runs the full provisioning flow before the cert expires — typically at the 60-day mark for Let's Encrypt 90-day certs. Zero downtime, zero manual action required.
On Windows Server / IIS, clients like win-acme (wacs.exe) and Certify The Web handle the full ACME flow, bind the cert to the IIS site binding, and register a scheduled renewal task automatically.