Why does my government PDF show a yellow question mark?

Indian government PDFs are digitally signed using certificates from NIC, eMudhra, or other CCA India licensed authorities. Adobe Acrobat and most PDF viewers don't include India's Root Certifying Authority (RCAI) in their default trusted certificate store. So even though the signature is completely valid and legally recognised under the Information Technology Act 2000, your PDF viewer shows a yellow question mark because it cannot automatically verify the issuer. Kagazo checks your PDF against the actual CCA India trust hierarchy and gives you a copy with a permanent green tick visible on any device.

Is my document safe? Do you store my PDF?

Your PDF is processed entirely in memory during verification. We never write your file to disk, never store it on our servers, and never share it with any third party. The file is deleted from memory immediately after verification is complete. You can also verify this by checking our open source backend code.

Which documents does Kagazo support?

Kagazo supports any PDF digitally signed under India's CCA certificate hierarchy. This includes e-Aadhaar, PAN card, DigiLocker documents, ITR-V, Form 16, and all state government certificates from Tamil Nadu e-District, AP and Telangana MeeSeva, Karnataka Nadakacheri and eJanma, Kerala Sevana portal, and more.

My Aadhaar PDF is password protected. Will it work?

Yes. Enter your Aadhaar password (first four letters of your name in capital letters followed by your birth year, for example RAMA1995) in the password field that appears after you upload your e-Aadhaar PDF. We decrypt it in memory, verify the signature, and return a verified copy.

What is the difference between "Signature Valid" and "Signature Unknown"?

Signature Valid means the document is genuinely issued by the government authority and has not been modified. Signature Unknown means your PDF viewer cannot verify the certificate chain — this is a viewer configuration issue, not a problem with your document. Signature Invalid means the document may have been tampered with or re-saved after signing.

Does this work on mobile?

Yes. Kagazo is fully mobile responsive and works on any Android or iOS browser. No app installation required. Simply open kagazo.in on your phone browser, upload your PDF and verify instantly.

Port 443 TLS Handshake • Real-Time x509 Inspection

SSL Certificate Checker & Expiry Monitor

Verify SSL/TLS certificate health instantly. Check days until expiration, certificate authority (CA), cipher suites, and protected Subject Alternative Names (SANs).

Root CA Chain Verification Expiration Countdown TLS 1.3 & Cipher Audit

Quick samples:

Key Components of an SSL/TLS Certificate

Every secure HTTPS transaction relies on cryptographic validation. Here is what our inspector checks:

Expiry Countdown (Days Left)

Most modern certificates (like Let’s Encrypt or Google Trust Services) expire every 90 days. Tracking remaining days prevents downtime.

Multi-Domain SANs

Subject Alternative Names list all wildcards and alternative subdomains covered by this same cryptographic public key.

Certificate Authority (CA) Chain

Verifies that the certificate traces back to a trusted root authority pre-installed in operating system trust stores.

Cryptographic Cipher Suite

Inspects symmetric encryption (e.g. AES-GCM or ChaCha20-Poly1305) and key exchange algorithms negotiated during the handshake.

Frequently Asked Questions

How do I know if my SSL certificate is valid and trusted?

Kagazo connects directly to port 443 of your web server and performs a full TLS handshake. If the certificate is issued by an approved root Certificate Authority (CA) and has not expired, it reports "SSL Valid & Trusted".

What are Subject Alternative Names (SANs)?

SANs allow a single SSL certificate to secure multiple domain names and subdomains (e.g., example.com, www.example.com, api.example.com) under one unified encryption certificate.

What happens when an SSL certificate expires?

When an SSL certificate expires, web browsers display a severe security barrier (e.g., "Your connection is not private" or "SEC_ERROR_EXPIRED_CERTIFICATE"), which blocks users from visiting your website and damages search engine rankings.

Which TLS version is the most secure today?

TLS 1.3 is the latest, fastest, and most secure transport protocol. It removes legacy vulnerable ciphers and completes cryptographic handshakes in just 1 round trip (1-RTT). TLS 1.2 remains widely supported and secure.