Checking for a certificate

A narrow tool with one important use: checking whether a site holds a certificate issued by the National Certification Centre.

The background

Such certificates are obtained through the Gosuslugi portal when a certificate from an international authority has been revoked. On issue, the recipient’s connection with the site is verified and the resource name is published in a public log at gosuslugi.ru/tls — so the issuance is a matter of public record, not a private transaction.

How to check

Console → Tools → Checking the NCC certificate, then enter the domain, for example example.com.

The instruction that reveals the point

Yandex says that if you have not requested a certificate but the console shows one exists, contact support. That is a security escalation rather than a configuration question: a certificate issued for a domain by somebody other than its owner is a serious matter, and this tool is how an owner would discover it.

Why certificate trust is not a settled question

A certificate one device chain accepts, another may reject. That is the scenario behind Yandex’s guidance on keeping an HTTP version reachable — so a visitor whose device does not trust the certificate can still open the site instead of meeting a security warning and leaving. The trust question and the protocol question are connected, and both affect whether the site is reachable at all.

Where it fits

Not in a weekly routine. Use it when the server response check reports an SSL fault, when a client’s audience reports certificate warnings you cannot reproduce from your own machine, or when you need to establish what has actually been issued for a domain. Knowing the tool exists is most of its value.