TLS posture

Nepal Internet Observatorypublic infrastructure

Reading the observatory store…

Certificates

Certificates are read by completing a real TLS handshake against each endpoint and recording the certificate the server presents. Nothing on this page is inferred from a hostname, a port number or a public transparency log — every row is a value a server volunteered to this vantage point.

TLS-capable endpoints

150

Open services on ports where a handshake is expected.

Certificates read

116

Endpoints that completed a handshake and presented a certificate.

Coverage

77.3%

Share of TLS-capable endpoints whose certificate was actually read.

Distinct certificates

7 of these have already expired.

Ports under observation

Coverage is measured against implicit-TLS ports (443, 8443, 465, 993, 995), where the handshake is the first thing on the wire, and STARTTLS ports (587, 143, 110, 25, 21), where the service advertises an upgrade after its greeting. A certificate behind a port this collector does not probe is absent from these figures by design, not by failure.

443 · 8443 · 465 · 993 · 995 · 587 · 143 · 110 · 25 · 21

Certificate authority

Grouped by the CA that signed the leaf. Intermediate names (R3, R10, YE2) are folded into their issuing authority, because the useful question is which authority an operator chose, not which intermediate served it.

Let's Encrypt29
Self-signed6
Issuer and subject are identical. These cannot be validated by any client and are typically management interfaces or placeholder certificates.
DigiCert4
Sectigo4
Other3
Amazon1

Negotiated protocol

The version the server agreed to during the handshake this collector completed, recorded per endpoint.

TLSv1.3103
TLSv1.213

Key algorithm

Read from the public key in the presented certificate.

RSA42
ECDSA5

Signature algorithm

Read from the certificate's own signature. A SHA-1 or MD5 signature is a finding rather than a curiosity: no public authority should be issuing one, and a client that accepts it is trusting a broken construction.

SHA256-RSA43
ECDSA-SHA3844

Not collected

This collector records the subject, issuer, common name, validity window, subject alternative names, key algorithm and signature algorithm. It does not record key size, cipher suite, OCSP or CRL reachability, HSTS or certificate transparency log membership, so no weak-key, weak-cipher or revocation figure appears above. Those are absent because they were never observed, not because nothing was found.

Expired certificates

Certificates whose validity window ended before the most recent observation. An expired certificate on a live endpoint is a service that is failing validation for every client that checks.

7 expired

Common name	Issuer	Expires	Key	Endpoint	Endpoints
worldlinkfoundation.org.np	CN=R3,O=Let's Encrypt,C=US	17 Jan 2024 05:29 UTC 3y ago	ECDSA	139.5.70.216	1
cpcalendars.vip.himalayanhosting.com	CN=R3,O=Let's Encrypt,C=US	05 Apr 2024 04:14 UTC 3y ago	RSA	36.253.137.6	1
no common name	O=Cambium Networks Ltd.	12 Mar 2025 08:05 UTC 19mo ago	RSA	139.5.70.253	1
asbnepal.gov.np	CN=R10,O=Let's Encrypt,C=US	18 Aug 2025 01:42 UTC 13mo ago	RSA	202.45.144.44	1
chatbot.adbl.gov.np	CN=R10,O=Let's Encrypt,C=US	15 Sep 2025 03:19 UTC 12mo ago	RSA	202.45.147.31	1
no common name	CN=GISPaasCustomCA	14 Nov 2025 14:53 UTC 10mo ago	RSA	139.5.70.252	1
*.server247.info	CN=Amazon RSA 2048 M02,O=Amazon,C=US	09 Aug 2026 23:59 UTC 44d ago	RSA	103.180.240.127	1

Expiring within 30 days

Still valid at the time of observation, but approaching the end of the window. These are the endpoints where an operator still has time to renew before clients begin refusing the connection.

5 in window

Common name	Issuer	Expires	Key	Endpoint	Endpoints
autoconfig.aaravadhikari.com.np	CN=YR1,O=Let's Encrypt,C=US	01 Oct 2026 04:51 UTC in 8d	RSA	202.63.243.186	1
*.namastepay.com	CN=Sectigo Public Server Authentication CA DV R36,O=Sectigo Limited,C=GB	12 Oct 2026 23:59 UTC in 20d	RSA	103.164.158.145	2
api-reports.dristi.com.np	CN=YR1,O=Let's Encrypt,C=US	14 Oct 2026 07:04 UTC in 22d	RSA	139.5.70.241	1
dacloud.himalayan.host	CN=YE2,O=Let's Encrypt,C=US	14 Oct 2026 15:34 UTC in 22d	ECDSA	36.253.137.4	8
autoconfig.nepalvps.iwebnepal.com.np	CN=YR1,O=Let's Encrypt,C=US	22 Oct 2026 11:59 UTC in 30d	RSA	103.250.133.231	7

Self-signed certificates

Detected by an issuer that is identical to the subject. A self-signed certificate is not necessarily a misconfiguration — management interfaces routinely use one — but it can never be validated by a client, so anything presented on a public service is worth an operator's attention.

6 self-signed

Common name	Issuer	Expires	Key	Endpoint	Endpoints
no common name	O=Cambium Networks Ltd.	12 Mar 2025 08:05 UTC 19mo ago	RSA	139.5.70.253	1
nestyhesty.net	CN=nestyhesty.net	24 Apr 2027 08:40 UTC in 7mo	RSA	103.235.199.20	1
abc.com	CN=abc.com	21 Jul 2027 11:12 UTC in 10mo	RSA	103.233.59.42	1
FortiGate	CN=FortiGate,O=Fortinet Ltd.	22 Jul 2027 07:17 UTC in 10mo	RSA	103.98.128.203	1
hcp1.vnetwork.com.np	CN=hcp1.vnetwork.com.np,OU=IT,O=Hestia Control Panel,L=San Francisco,ST=California,C=US	06 Sep 2027 17:31 UTC in 12mo	RSA	160.30.33.38	1
np-ktm-as17501.anchors.atlas.ripe.net	CN=np-ktm-as17501.anchors.atlas.ripe.net	15 Mar 2125 10:42 UTC in 100y	RSA	139.5.70.209	1

RequestGET https://observatory.nirajp.com.np/api/v1/tls/overview?expiringDays=30

Most recent certificate observed

22 Sep 2026 19:27 UTC

4m ago

Earliest certificate record

22 Sep 2026 03:18 UTC

The age of this window bounds every longitudinal claim this dataset can support.