add: DES-08
This commit is contained in:
+53
-3
@@ -3,7 +3,7 @@
|
||||
| DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. |
|
||||
| DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code | Open | Test not yet performed. |
|
||||
| DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. |
|
||||
| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | Open | Test not yet performed. |
|
||||
| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | PASS (with findings) | Device: no outdated software on the bridge's exposed interface. Ecosystem (LOQED/Shelly cloud): TLS broadly strong, but low/medium hardening issues, client-initiated renegotiation on `shelly-120:6113` (DoS), TLS 1.3 absent on 2 hosts, outdated nginx 1.21.6 on integrations, version/OS & Express banners, shared `*.shelly.cloud wildcard cert`, missing HSTS, BREACH preconditions on 2 hosts. |
|
||||
| DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | PASS | No unnecesarrily open ports on the bridge |
|
||||
| DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. |
|
||||
| DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. |
|
||||
@@ -28,7 +28,57 @@
|
||||
|
||||
### DES-08
|
||||
|
||||
- **Verdict: Open**
|
||||
The DES considered for this test are:
|
||||
- `mqtt.production.loqed.com:8883`
|
||||
- `integrations.loqed.com:443`
|
||||
- No HSTS header
|
||||
- Outdated nginx
|
||||
- `api.production.loqed.com:443`
|
||||
- No HSTS header
|
||||
- All of the above:
|
||||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||
|
||||
|
||||
And the shelly cloud services:
|
||||
- `control.shelly.cloud:443`
|
||||
- No HSTS header
|
||||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||
- Potentially vuln. to CVE-2013-3587
|
||||
- Google’s/Shelly’s hosting config
|
||||
- `shelly-120-eu.shelly.cloud:443`
|
||||
- No HSTS header
|
||||
- Exposes nginx and Ubuntu OS
|
||||
- `:6113`
|
||||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||
- **Vulnerable to secure client-initiated renegotiation**
|
||||
- `shelly-101-eu.shelly.cloud:31234`
|
||||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||
- No HSTS header
|
||||
- `shelly-infra1-eu.shelly.cloud:443`
|
||||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||
- No HSTS header
|
||||
- Exposes nginx and Ubuntu OS
|
||||
- **No TLS 1.3**
|
||||
- `:9443`
|
||||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||
- Exposes application banner x-powered-by express
|
||||
- No HSTS header
|
||||
- `changelog-backend.shelly.cloud:443`
|
||||
- **No TLS 1.3**
|
||||
- Exposes nginx and Ubuntu OS
|
||||
- Potentially vuln. to CVE-2013-3587
|
||||
- Google’s/Shelly’s hosting config
|
||||
- `repo.shelly.cloud:443`
|
||||
- Exposes nginx and Ubuntu OS
|
||||
- All `*.shelly.cloud` use wildcard cert.
|
||||
|
||||
```bash
|
||||
testssl -oA <output> <target>
|
||||
```
|
||||
|
||||
- **Results**: [testssl reports](test_case_evidence/DES/DES08/)
|
||||
|
||||
- **Verdict: PASS (with findings)**
|
||||
|
||||
### DES-09
|
||||
|
||||
@@ -46,7 +96,7 @@ In our network it currently has the address `10.12.2.30`.
|
||||
> After the factory reset I had to reconfigure the bridge to determine its new IP.
|
||||
> The procedure was captured [here](network/captures/init_after_reset.pcapng) and re-run through the PreTester [here](network/pretester_reports/init_after_reset_report.md).
|
||||
|
||||
- **Result**: [nmap report](network/nmap/des09_bridge.nmap)
|
||||
- **Result**: [nmap report](test_case_evidence/DES/DES09/des09_bridge.nmap)
|
||||
|
||||
Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext).
|
||||
All other ports are filtered.
|
||||
|
||||
@@ -0,0 +1,172 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","api.production.loqed.com/34.155.200.196","443","INFO","HTTP","",""
|
||||
"pre_128cipher","api.production.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","api.production.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||
"SSLv3","api.production.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||
"TLS1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"TLS1_1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"TLS1_2","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"TLS1_3","api.production.loqed.com/34.155.200.196","443","OK","offered with final","",""
|
||||
"NPN","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"ALPN_HTTP2","api.production.loqed.com/34.155.200.196","443","OK","h2","",""
|
||||
"ALPN","api.production.loqed.com/34.155.200.196","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","api.production.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","api.production.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||
"cipher-tls1_2_xc02f","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc013","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc014","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9c","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9d","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x2f","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x35","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","true","",""
|
||||
"cipher_order-tls1_3","api.production.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","api.production.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","",""
|
||||
"FS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"FS_ciphers","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||
"FS_KEMs","api.production.loqed.com/34.155.200.196","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","api.production.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||
"FS_TLS12_sig_algs","api.production.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||
"FS_TLS13_sig_algs","api.production.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","api.production.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","api.production.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","",""
|
||||
"SSL_sessionID_support","api.production.loqed.com/34.155.200.196","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","api.production.loqed.com/34.155.200.196","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","api.production.loqed.com/34.155.200.196","443","INFO","supported","",""
|
||||
"TLS_timestamp","api.production.loqed.com/34.155.200.196","443","INFO","random","",""
|
||||
"certificate_compression","api.production.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||
"clientAuth","api.production.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||
"cert_numbers","api.production.loqed.com/34.155.200.196","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","api.production.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","api.production.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","api.production.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","api.production.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","api.production.loqed.com/34.155.200.196","443","INFO","056B01F8C0078A7719EB49BF14357173112F","",""
|
||||
"cert_serialNumberLen","api.production.loqed.com/34.155.200.196","443","INFO","18","",""
|
||||
"cert_fingerprintSHA1","api.production.loqed.com/34.155.200.196","443","INFO","6A4E93FA165A64A590BF098743A6D7DD99911DEE","",""
|
||||
"cert_fingerprintSHA256","api.production.loqed.com/34.155.200.196","443","INFO","11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","",""
|
||||
"cert","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","api.production.loqed.com/34.155.200.196","443","OK","api.production.loqed.com","",""
|
||||
"cert_commonName_wo_SNI","api.production.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","",""
|
||||
"cert_subjectAltName","api.production.loqed.com/34.155.200.196","443","INFO","api.production.loqed.com","",""
|
||||
"cert_trust","api.production.loqed.com/34.155.200.196","443","OK","Ok via SAN and CN (SNI mandatory)","",""
|
||||
"cert_chain_of_trust","api.production.loqed.com/34.155.200.196","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","api.production.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||
"cert_expirationStatus","api.production.loqed.com/34.155.200.196","443","OK","86 >= 30 days","",""
|
||||
"cert_notBefore","api.production.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:16","",""
|
||||
"cert_notAfter","api.production.loqed.com/34.155.200.196","443","OK","2027-01-30 01:16","",""
|
||||
"cert_extlifeSpan","api.production.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","api.production.loqed.com/34.155.200.196","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","api.production.loqed.com/34.155.200.196","443","INFO","http://yr2.c.lencr.org/48.crl","",""
|
||||
"cert_ocspURL","api.production.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||
"OCSP_stapling","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","api.production.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||
"DNS_CAArecord","api.production.loqed.com/34.155.200.196","443","LOW","--","",""
|
||||
"certificate_transparency","api.production.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","api.production.loqed.com/34.155.200.196","443","INFO","3","",""
|
||||
"certs_list_ordering_problem","api.production.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||
"cert_caIssuers","api.production.loqed.com/34.155.200.196","443","INFO","YR2 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","api.production.loqed.com/34.155.200.196","443","INFO","238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47","",""
|
||||
"intermediate_cert_notBefore <#1>","api.production.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","api.production.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","api.production.loqed.com/34.155.200.196","443","INFO","YR2 <-- Root YR","",""
|
||||
"intermediate_cert <#2>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","api.production.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||
"intermediate_cert_notBefore <#2>","api.production.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","api.production.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","api.production.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","api.production.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","api.production.loqed.com/34.155.200.196","443","WARN","Unexpected 415 Unsupported Media Type @ '/'","",""
|
||||
"HTTP_clock_skew","api.production.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","api.production.loqed.com/34.155.200.196","443","INFO","1793777783","",""
|
||||
"HSTS","api.production.loqed.com/34.155.200.196","443","LOW","not offered","",""
|
||||
"HPKP","api.production.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","api.production.loqed.com/34.155.200.196","443","INFO","No Server banner line in header, interesting!","",""
|
||||
"banner_application","api.production.loqed.com/34.155.200.196","443","INFO","No application banner found","",""
|
||||
"cookie_count","api.production.loqed.com/34.155.200.196","443","INFO","1 at '/' (maybe missed the application)","",""
|
||||
"cookie_secure","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as secure","",""
|
||||
"cookie_httponly","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as HttpOnly (maybe missed the application)","",""
|
||||
"security_headers","api.production.loqed.com/34.155.200.196","443","MEDIUM","--","",""
|
||||
"banner_reverseproxy","api.production.loqed.com/34.155.200.196","443","INFO","--","","CWE-200"
|
||||
"heartbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","api.production.loqed.com/34.155.200.196","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","api.production.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","api.production.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","api.production.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","api.production.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","api.production.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_winphone81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","api.production.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1102","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_2106","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-go_1178","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_315","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_350","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-apple_mail_16_0","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","api.production.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","api.production.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","api.production.loqed.com/34.155.200.196","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","30","",""
|
||||
"key_exchange_score","api.production.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","27","",""
|
||||
"cipher_strength_score","api.production.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","36","",""
|
||||
"final_score","api.production.loqed.com/34.155.200.196","443","INFO","93","",""
|
||||
"overall_grade","api.production.loqed.com/34.155.200.196","443","OK","A+","",""
|
||||
|
@@ -0,0 +1,225 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<--</span>
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
|
||||
SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>api.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>api.production.loqed.com </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (SNI mandatory)
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:16 --> 2027-01-30 01:16)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr2.c.lencr.org/48.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YR2</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR2</i> <-- <i>Root YR</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 415 Unsupported Media Type<span style="color:#cd00cd;">. Oh, didn't expect "415 Unsupported Media Type"</span>
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>1 issued: <span style="color:#008817;">1/1</span> secure, <span style="color:#008817;">1/1</span> HttpOnly -- HTTP status 415 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span><span style="color:#c05600;">--</span>
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,777 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793777755",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "api.production.loqed.com",
|
||||
"ip" : "34.155.200.196",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN_HTTP2",
|
||||
"severity" : "OK",
|
||||
"finding" : "h2"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "true"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- TLS 1.3 client determined"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "LOW",
|
||||
"finding" : "valid for 604800 seconds (>daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "056B01F8C0078A7719EB49BF14357173112F"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "6A4E93FA165A64A590BF098743A6D7DD99911DEE"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "api.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TRAEFIK DEFAULT CERT"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "api.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (SNI mandatory)"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "86 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-11-01 01:16"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-30 01:16"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://yr2.c.lencr.org/48.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR2 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR2 <-- Root YR"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YR <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "WARN",
|
||||
"finding" : "Unexpected 415 Unsupported Media Type @ '/'"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793777783"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No Server banner line in header, interesting!"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "cookie_secure",
|
||||
"severity" : "OK",
|
||||
"finding" : "All (1) at '/' marked as secure"
|
||||
},{
|
||||
"id" : "cookie_httponly",
|
||||
"severity" : "OK",
|
||||
"finding" : "All (1) at '/' marked as HttpOnly (maybe missed the application)"
|
||||
},{
|
||||
"id" : "security_headers",
|
||||
"severity" : "MEDIUM",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 67
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<--[m
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: yes
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
|
||||
SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||
[1m Common Name (CN) [m[3mapi.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||
[1m subjectAltName (SAN) [m[3mapi.production.loqed.com [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (SNI mandatory)
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:16 --> 2027-01-30 01:16)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://yr2.c.lencr.org/48.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 3
|
||||
[1m Issuer [m[3mYR2[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR2[m <-- [3mRoot YR[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 415 Unsupported Media Type[0;35m. Oh, didn't expect "415 Unsupported Media Type"[m
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m1 issued: [0;32m1/1[m secure, [0;32m1/1[m HttpOnly -- HTTP status 415 signals you maybe missed the web application
|
||||
[1m Security headers [m[0;33m--[m
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,172 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","integrations.loqed.com/34.155.200.196","443","INFO","HTTP","",""
|
||||
"pre_128cipher","integrations.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","integrations.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||
"SSLv3","integrations.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||
"TLS1","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"TLS1_1","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"TLS1_2","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"TLS1_3","integrations.loqed.com/34.155.200.196","443","OK","offered with final","",""
|
||||
"NPN","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"ALPN_HTTP2","integrations.loqed.com/34.155.200.196","443","OK","h2","",""
|
||||
"ALPN","integrations.loqed.com/34.155.200.196","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","integrations.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","integrations.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||
"cipher-tls1_2_xc02f","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc013","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc014","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9c","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9d","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x2f","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x35","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","integrations.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","integrations.loqed.com/34.155.200.196","443","INFO","true","",""
|
||||
"cipher_order-tls1_3","integrations.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","integrations.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","integrations.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","",""
|
||||
"FS","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"FS_ciphers","integrations.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||
"FS_KEMs","integrations.loqed.com/34.155.200.196","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","integrations.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||
"FS_TLS12_sig_algs","integrations.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||
"FS_TLS13_sig_algs","integrations.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","integrations.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","integrations.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","",""
|
||||
"SSL_sessionID_support","integrations.loqed.com/34.155.200.196","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","integrations.loqed.com/34.155.200.196","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","integrations.loqed.com/34.155.200.196","443","INFO","supported","",""
|
||||
"TLS_timestamp","integrations.loqed.com/34.155.200.196","443","INFO","random","",""
|
||||
"certificate_compression","integrations.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||
"clientAuth","integrations.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||
"cert_numbers","integrations.loqed.com/34.155.200.196","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","integrations.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","integrations.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","integrations.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","integrations.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","integrations.loqed.com/34.155.200.196","443","INFO","05C73CE106F84ABAC4E6D524DA93450B2C1C","",""
|
||||
"cert_serialNumberLen","integrations.loqed.com/34.155.200.196","443","INFO","18","",""
|
||||
"cert_fingerprintSHA1","integrations.loqed.com/34.155.200.196","443","INFO","80EDD7ED1004483BFF5FAC76EEB5BD58638464FF","",""
|
||||
"cert_fingerprintSHA256","integrations.loqed.com/34.155.200.196","443","INFO","F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962","",""
|
||||
"cert","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFNTCCBB2gAwIBAgISBcc84Qb4SrrE5tUk2pNFCywcMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAsMSowKAYDVQQDEyFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPWD0p9X/7gALsv5hZ8dAORgWdrVJVMiDF8goE/bywu79SsUIgjHP3ydju2CM14hvVPPFbvBHNBtisztJKz22JoqMYA+06nnlGjrxwaffepVTOlbvcrgyEOUW6uOz2PvHSR7KdatSJtfzkIhbF40DR85dYFn8MupGWcF830IaxvdeRqx+zhFFhzoNht0LwGLfqHGsUQyMcV5TM1070sUax6pNZuDcHi9NAOB8o/H5K9+awQ9tKfoTk1oPNWEjRPngjUZFukwlNwpTVevpiKSpp9UEcDSQzyXLD6TUbv0Y/asaDfo2yB9ozPxB4RxTbf4bMKXtgz6yJtmu6hsNxL5H7AgMBAAGjggJIMIICRDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUNf4wq1Iwtu2hTtj593uN4a2+quAwHwYDVR0jBBgwFoAUHy81vkYUgs1Asa55LFV4+vfUaPswMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIxLmkubGVuY3Iub3JnLzBEBgNVHREEPTA7ghZpbnRlZ3JhdGlvbnMubG9xZWQuY29tgiFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMS5jLmxlbmNyLm9yZy8yOS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgAAGl0aHC2TdbZIVXj4L3Ghrm7vOX0pfIrjFXvK3uGgHgAAAaGU3eXqAAAEAwBHMEUCIQCKrChfG4RVUy8Kp/suqQk9z3zDWpfjaQHS0437j28xvQIgSRyUMHc52kEyt2hO/x2yT8iahsWSU7VKFKGSEIuFa7AAfwBZbmwzhpSyWXKiVsig6N2QSnboCD3ahzsBCDgoFDzuWQAAAaGU3eZsAAgAAAUAGXbecwQDAEgwRgIhAKVoN8aabyItWJCrOqKTNt0qEpBs6Ooj1irv3yArILyrAiEAn8DXmfxWE/FsZBioMOOFHIJ2o1lFosHWnnrwbJGBFmkwDQYJKoZIhvcNAQELBQADggEBAEZEghbiA63425KThlZ5LQyhwRX6D+LLSrIqPb++Grz3DFEiIbQ7uNnexeSwaYXVmD1tsx0zXbSi3fDxP+KveynVLxdZQ8C78DMdAC0fk21/ZOyfwZ6v+c6HMJnaRRNFfIrFBaIdJQNsAGYhghB6zRcGqq9ye+4GnmvjNWFWAdxKZP0AUuNzxH66etPrWgDUlSJDwAsnU2dENJTQB/juN2VdIFu+bnZRDp2C5eMPHPZIX7P2sxwf2wXFmVqXCB3nKJKZuT1JJWlwwowPG0ZBpelC1ExMEBbgmTHZsebT/ILMmqPE+UkSYqsDEWNTNNGg6Td+hzUSDlUeJRKwpBSSXvA=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","integrations.loqed.com/34.155.200.196","443","OK","integrations.production.loqed.com","",""
|
||||
"cert_commonName_wo_SNI","integrations.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","",""
|
||||
"cert_subjectAltName","integrations.loqed.com/34.155.200.196","443","INFO","integrations.loqed.com integrations.production.loqed.com","",""
|
||||
"cert_trust","integrations.loqed.com/34.155.200.196","443","OK","Ok via SAN (SNI mandatory)","",""
|
||||
"cert_chain_of_trust","integrations.loqed.com/34.155.200.196","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","integrations.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||
"cert_expirationStatus","integrations.loqed.com/34.155.200.196","443","OK","86 >= 30 days","",""
|
||||
"cert_notBefore","integrations.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:10","",""
|
||||
"cert_notAfter","integrations.loqed.com/34.155.200.196","443","OK","2027-01-30 01:10","",""
|
||||
"cert_extlifeSpan","integrations.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","integrations.loqed.com/34.155.200.196","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","integrations.loqed.com/34.155.200.196","443","INFO","http://yr1.c.lencr.org/29.crl","",""
|
||||
"cert_ocspURL","integrations.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||
"OCSP_stapling","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","integrations.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||
"DNS_CAArecord","integrations.loqed.com/34.155.200.196","443","LOW","--","",""
|
||||
"certificate_transparency","integrations.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","integrations.loqed.com/34.155.200.196","443","INFO","3","",""
|
||||
"certs_list_ordering_problem","integrations.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||
"cert_caIssuers","integrations.loqed.com/34.155.200.196","443","INFO","YR1 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","integrations.loqed.com/34.155.200.196","443","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","",""
|
||||
"intermediate_cert_notBefore <#1>","integrations.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","integrations.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","integrations.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","integrations.loqed.com/34.155.200.196","443","INFO","YR1 <-- Root YR","",""
|
||||
"intermediate_cert <#2>","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","integrations.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||
"intermediate_cert_notBefore <#2>","integrations.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","integrations.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","integrations.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","integrations.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","integrations.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","integrations.loqed.com/34.155.200.196","443","INFO","302 Found ('/')","",""
|
||||
"HTTP_clock_skew","integrations.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","integrations.loqed.com/34.155.200.196","443","INFO","1793777307","",""
|
||||
"HSTS","integrations.loqed.com/34.155.200.196","443","LOW","not offered","",""
|
||||
"HPKP","integrations.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","integrations.loqed.com/34.155.200.196","443","INFO","nginx/1.21.6","",""
|
||||
"banner_application","integrations.loqed.com/34.155.200.196","443","INFO","X-Powered-By: PHP/8.2.35","",""
|
||||
"cookie_count","integrations.loqed.com/34.155.200.196","443","INFO","2 at '/' (30x detected, better try target URL of 30x)","",""
|
||||
"cookie_secure","integrations.loqed.com/34.155.200.196","443","INFO","1/2 at '/' marked as secure","",""
|
||||
"cookie_httponly","integrations.loqed.com/34.155.200.196","443","OK","All (2) at '/' marked as HttpOnly (30x detected, better try target URL of 30x)","",""
|
||||
"Cache-Control","integrations.loqed.com/34.155.200.196","443","INFO","no-cache, private","",""
|
||||
"banner_reverseproxy","integrations.loqed.com/34.155.200.196","443","INFO","--","","CWE-200"
|
||||
"heartbleed","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","integrations.loqed.com/34.155.200.196","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","integrations.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","integrations.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","integrations.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","integrations.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","integrations.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_winphone81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","integrations.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1102","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_2106","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-go_1178","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_315","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_350","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-apple_mail_16_0","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","integrations.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","integrations.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","integrations.loqed.com/34.155.200.196","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","30","",""
|
||||
"key_exchange_score","integrations.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","27","",""
|
||||
"cipher_strength_score","integrations.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","36","",""
|
||||
"final_score","integrations.loqed.com/34.155.200.196","443","INFO","93","",""
|
||||
"overall_grade","integrations.loqed.com/34.155.200.196","443","OK","A+","",""
|
||||
|
@@ -0,0 +1,225 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:28:00 -->> 34.155.200.196:443 (integrations.loqed.com) <<--</span>
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>05C73CE106F84ABAC4E6D524DA93450B2C1C (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 80EDD7ED1004483BFF5FAC76EEB5BD58638464FF
|
||||
SHA256 F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>integrations.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>integrations.loqed.com integrations.production.loqed.com </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN</span> (SNI mandatory)
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr1.c.lencr.org/29.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YR1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR1</i> <-- <i>Root YR</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 302 Found, redirecting to "<a href="dashboard" style="color:black;text-decoration:none;">dashboard</a>"
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">6</span>'
|
||||
<span style="font-weight:bold;"> Application banner </span><span style="color:#8a7237;font-weight:bold;">X-Powered-By</span>: PHP/<span style="color:#8a7237;">8</span>.<span style="color:#8a7237;">2</span>.<span style="color:#8a7237;">3</span><span style="color:#8a7237;">5</span>'
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>2 issued: <span style="color:#008817;">1/2</span> secure, <span style="color:#008817;">2/2</span> HttpOnly -- maybe better try target URL of 30x
|
||||
<span style="font-weight:bold;"> Security headers </span>Cache-Control: no-cache, private
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:29:06 [ 68s] -->> 34.155.200.196:443 (integrations.loqed.com) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,777 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_loqed_integrations integrations.loqed.com:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793777278",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "integrations.loqed.com",
|
||||
"ip" : "34.155.200.196",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN_HTTP2",
|
||||
"severity" : "OK",
|
||||
"finding" : "h2"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "true"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- TLS 1.3 client determined"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "LOW",
|
||||
"finding" : "valid for 604800 seconds (>daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "05C73CE106F84ABAC4E6D524DA93450B2C1C"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "80EDD7ED1004483BFF5FAC76EEB5BD58638464FF"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFNTCCBB2gAwIBAgISBcc84Qb4SrrE5tUk2pNFCywcMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAsMSowKAYDVQQDEyFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPWD0p9X/7gALsv5hZ8dAORgWdrVJVMiDF8goE/bywu79SsUIgjHP3ydju2CM14hvVPPFbvBHNBtisztJKz22JoqMYA+06nnlGjrxwaffepVTOlbvcrgyEOUW6uOz2PvHSR7KdatSJtfzkIhbF40DR85dYFn8MupGWcF830IaxvdeRqx+zhFFhzoNht0LwGLfqHGsUQyMcV5TM1070sUax6pNZuDcHi9NAOB8o/H5K9+awQ9tKfoTk1oPNWEjRPngjUZFukwlNwpTVevpiKSpp9UEcDSQzyXLD6TUbv0Y/asaDfo2yB9ozPxB4RxTbf4bMKXtgz6yJtmu6hsNxL5H7AgMBAAGjggJIMIICRDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUNf4wq1Iwtu2hTtj593uN4a2+quAwHwYDVR0jBBgwFoAUHy81vkYUgs1Asa55LFV4+vfUaPswMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIxLmkubGVuY3Iub3JnLzBEBgNVHREEPTA7ghZpbnRlZ3JhdGlvbnMubG9xZWQuY29tgiFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMS5jLmxlbmNyLm9yZy8yOS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgAAGl0aHC2TdbZIVXj4L3Ghrm7vOX0pfIrjFXvK3uGgHgAAAaGU3eXqAAAEAwBHMEUCIQCKrChfG4RVUy8Kp/suqQk9z3zDWpfjaQHS0437j28xvQIgSRyUMHc52kEyt2hO/x2yT8iahsWSU7VKFKGSEIuFa7AAfwBZbmwzhpSyWXKiVsig6N2QSnboCD3ahzsBCDgoFDzuWQAAAaGU3eZsAAgAAAUAGXbecwQDAEgwRgIhAKVoN8aabyItWJCrOqKTNt0qEpBs6Ooj1irv3yArILyrAiEAn8DXmfxWE/FsZBioMOOFHIJ2o1lFosHWnnrwbJGBFmkwDQYJKoZIhvcNAQELBQADggEBAEZEghbiA63425KThlZ5LQyhwRX6D+LLSrIqPb++Grz3DFEiIbQ7uNnexeSwaYXVmD1tsx0zXbSi3fDxP+KveynVLxdZQ8C78DMdAC0fk21/ZOyfwZ6v+c6HMJnaRRNFfIrFBaIdJQNsAGYhghB6zRcGqq9ye+4GnmvjNWFWAdxKZP0AUuNzxH66etPrWgDUlSJDwAsnU2dENJTQB/juN2VdIFu+bnZRDp2C5eMPHPZIX7P2sxwf2wXFmVqXCB3nKJKZuT1JJWlwwowPG0ZBpelC1ExMEBbgmTHZsebT/ILMmqPE+UkSYqsDEWNTNNGg6Td+hzUSDlUeJRKwpBSSXvA=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "integrations.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TRAEFIK DEFAULT CERT"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "integrations.loqed.com integrations.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN (SNI mandatory)"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "86 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-11-01 01:10"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-30 01:10"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://yr1.c.lencr.org/29.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR1 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR1 <-- Root YR"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YR <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "302 Found ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793777307"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.21.6"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "X-Powered-By: PHP/8.2.35"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2 at '/' (30x detected, better try target URL of 30x)"
|
||||
},{
|
||||
"id" : "cookie_secure",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1/2 at '/' marked as secure"
|
||||
},{
|
||||
"id" : "cookie_httponly",
|
||||
"severity" : "OK",
|
||||
"finding" : "All (2) at '/' marked as HttpOnly (30x detected, better try target URL of 30x)"
|
||||
},{
|
||||
"id" : "Cache-Control",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no-cache, private"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 68
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_loqed_integrations integrations.loqed.com:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:28:00 -->> 34.155.200.196:443 (integrations.loqed.com) <<--[m
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: yes
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m05C73CE106F84ABAC4E6D524DA93450B2C1C (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 80EDD7ED1004483BFF5FAC76EEB5BD58638464FF
|
||||
SHA256 F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
|
||||
[1m Common Name (CN) [m[3mintegrations.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||
[1m subjectAltName (SAN) [m[3mintegrations.loqed.com integrations.production.loqed.com [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN[m (SNI mandatory)
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://yr1.c.lencr.org/29.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 3
|
||||
[1m Issuer [m[3mYR1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR1[m <-- [3mRoot YR[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 302 Found, redirecting to "dashboard"
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m1(B[m.[33m6(B[m
|
||||
[1m Application banner [m[33m[1mX-Powered-By(B[m: PHP/[33m8(B[m.[33m2(B[m.[33m3(B[m[33m5(B[m
|
||||
[1m Cookie(s) [m2 issued: [0;32m1/2[m secure, [0;32m2/2[m HttpOnly -- maybe better try target URL of 30x
|
||||
[1m Security headers [mCache-Control: no-cache, private
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:29:06 [ 68s] -->> 34.155.200.196:443 (integrations.loqed.com) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,159 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","mqtt.production.loqed.com/34.155.200.196","8883","DEBUG","Couldn't determine service, skipping all HTTP checks","",""
|
||||
"pre_128cipher","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","",""
|
||||
"SSLv3","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","",""
|
||||
"TLS1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"TLS1_1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"TLS1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"TLS1_3","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered with final","",""
|
||||
"NPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"ALPN_HTTP2","mqtt.production.loqed.com/34.155.200.196","8883","OK","h2","",""
|
||||
"ALPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","mqtt.production.loqed.com/34.155.200.196","8883","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"cipher_order-tls1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||
"cipher-tls1_2_xc02f","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc013","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc014","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9c","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9d","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x2f","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x35","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","true","",""
|
||||
"cipher_order-tls1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- TLS 1.3 client determined","",""
|
||||
"FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"FS_ciphers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||
"FS_KEMs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","mqtt.production.loqed.com/34.155.200.196","8883","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||
"FS_TLS12_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||
"FS_TLS13_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","mqtt.production.loqed.com/34.155.200.196","8883","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","mqtt.production.loqed.com/34.155.200.196","8883","LOW","valid for 604800 seconds (>daily)","",""
|
||||
"SSL_sessionID_support","mqtt.production.loqed.com/34.155.200.196","8883","INFO","yes","",""
|
||||
"sessionresumption_ticket","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","",""
|
||||
"sessionresumption_ID","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","",""
|
||||
"TLS_timestamp","mqtt.production.loqed.com/34.155.200.196","8883","INFO","random","",""
|
||||
"certificate_compression","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","",""
|
||||
"clientAuth","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","",""
|
||||
"cert_numbers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","1","",""
|
||||
"cert_signatureAlgorithm","mqtt.production.loqed.com/34.155.200.196","8883","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","mqtt.production.loqed.com/34.155.200.196","8883","INFO","06E81D5B9CC230FE76507D0EA12EE2BF2BE6","",""
|
||||
"cert_serialNumberLen","mqtt.production.loqed.com/34.155.200.196","8883","INFO","18","",""
|
||||
"cert_fingerprintSHA1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","A5D4BB82B189F9E7924595FFCF31411019B6087F","",""
|
||||
"cert_fingerprintSHA256","mqtt.production.loqed.com/34.155.200.196","8883","INFO","AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","",""
|
||||
"cert","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","mqtt.production.loqed.com/34.155.200.196","8883","OK","mqtt.production.loqed.com","",""
|
||||
"cert_commonName_wo_SNI","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TRAEFIK DEFAULT CERT","",""
|
||||
"cert_subjectAltName","mqtt.production.loqed.com/34.155.200.196","8883","INFO","mqtt.production.loqed.com","",""
|
||||
"cert_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","Ok via SAN and CN (SNI mandatory)","",""
|
||||
"cert_chain_of_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","",""
|
||||
"cert_expirationStatus","mqtt.production.loqed.com/34.155.200.196","8883","OK","86 >= 30 days","",""
|
||||
"cert_notBefore","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-11-01 01:10","",""
|
||||
"cert_notAfter","mqtt.production.loqed.com/34.155.200.196","8883","OK","2027-01-30 01:10","",""
|
||||
"cert_extlifeSpan","mqtt.production.loqed.com/34.155.200.196","8883","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http://yr1.c.lencr.org/103.crl","",""
|
||||
"cert_ocspURL","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","",""
|
||||
"OCSP_stapling","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","",""
|
||||
"DNS_CAArecord","mqtt.production.loqed.com/34.155.200.196","8883","LOW","--","",""
|
||||
"certificate_transparency","mqtt.production.loqed.com/34.155.200.196","8883","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","mqtt.production.loqed.com/34.155.200.196","8883","INFO","3","",""
|
||||
"certs_list_ordering_problem","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","",""
|
||||
"cert_caIssuers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","",""
|
||||
"intermediate_cert_notBefore <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 <-- Root YR","",""
|
||||
"intermediate_cert <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||
"intermediate_cert_notBefore <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Root YR <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","mqtt.production.loqed.com/34.155.200.196","8883","OK","intermediate certificate(s) is/are ok","",""
|
||||
"heartbleed","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","supported","","CWE-310"
|
||||
"secure_client_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310"
|
||||
"POODLE_SSL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","mqtt.production.loqed.com/34.155.200.196","8883","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","mqtt.production.loqed.com/34.155.200.196","8883","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","mqtt.production.loqed.com/34.155.200.196","8883","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_winphone81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1102","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_2106","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-go_1178","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_315","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_350","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-apple_mail_16_0","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","mqtt.production.loqed.com/34.155.200.196","8883","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","mqtt.production.loqed.com/34.155.200.196","8883","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","100","",""
|
||||
"protocol_support_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","30","",""
|
||||
"key_exchange_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","",""
|
||||
"key_exchange_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","27","",""
|
||||
"cipher_strength_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","",""
|
||||
"cipher_strength_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","36","",""
|
||||
"final_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","93","",""
|
||||
"overall_grade","mqtt.production.loqed.com/34.155.200.196","8883","OK","A+","",""
|
||||
|
@@ -0,0 +1,212 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--</span>
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
|
||||
SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>mqtt.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>mqtt.production.loqed.com </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (SNI mandatory)
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr1.c.lencr.org/103.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YR1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR1</i> <-- <i>Root YR</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span> (not using HTTP anyway)
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
Could not determine the protocol, only simulating generic clients.
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,722 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793776604",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "mqtt.production.loqed.com",
|
||||
"ip" : "34.155.200.196",
|
||||
"port" : "8883",
|
||||
"rDNS" : "--",
|
||||
"service" : "Couldn't determine service, skipping all HTTP checks",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN_HTTP2",
|
||||
"severity" : "OK",
|
||||
"finding" : "h2"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "true"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- TLS 1.3 client determined"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "LOW",
|
||||
"finding" : "valid for 604800 seconds (>daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "06E81D5B9CC230FE76507D0EA12EE2BF2BE6"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "A5D4BB82B189F9E7924595FFCF31411019B6087F"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "mqtt.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TRAEFIK DEFAULT CERT"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "mqtt.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (SNI mandatory)"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "86 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-11-01 01:10"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-30 01:10"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://yr1.c.lencr.org/103.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR1 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR1 <-- Root YR"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YR <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not applicable, not HTTP"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable (not using HTTP anyway)"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 64
|
||||
}
|
||||
@@ -0,0 +1,191 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--[m
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
|
||||
SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||
[1m Common Name (CN) [m[3mmqtt.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||
[1m subjectAltName (SAN) [m[3mmqtt.production.loqed.com [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (SNI mandatory)
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://yr1.c.lencr.org/103.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 3
|
||||
[1m Issuer [m[3mYR1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR1[m <-- [3mRoot YR[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m (not using HTTP anyway)
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
Could not determine the protocol, only simulating generic clients.
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,174 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","HTTP","",""
|
||||
"pre_128cipher","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","",""
|
||||
"SSLv3","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","",""
|
||||
"TLS1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"TLS1_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"TLS1_2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||
"TLS1_3","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered + downgraded to weaker protocol","",""
|
||||
"NPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"ALPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"cipherlist_STRONG_FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_2_xc02c","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca9","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc02b","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"cipher_order","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a server cipher order configured","",""
|
||||
"FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||
"FS_ciphers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"FS_KEMs","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","changelog-backend.shelly.cloud/34.62.47.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"FS_TLS12_sig_algs","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224","",""
|
||||
"TLS_extensions","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no -- no lifetime advertised","",""
|
||||
"SSL_sessionID_support","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","",""
|
||||
"TLS_timestamp","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","random","",""
|
||||
"cert_compression","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","N/A","",""
|
||||
"clientAuth","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","none","",""
|
||||
"cert_numbers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ECDSA with SHA384","",""
|
||||
"cert_keySize","changelog-backend.shelly.cloud/34.62.47.252","443","OK","EC 256 bits (curve P-256)","",""
|
||||
"cert_keyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Digital Signature","",""
|
||||
"cert_extKeyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0582918DB89B4A8A742D84FD104CDC41D76B","",""
|
||||
"cert_serialNumberLen","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","18","",""
|
||||
"cert_fingerprintSHA1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2B1B2A1E33BDD140FA382D85F749503A2CEB16FD","",""
|
||||
"cert_fingerprintSHA256","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF","",""
|
||||
"cert","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","changelog-backend.shelly.cloud/34.62.47.252","443","OK","changelog-backend.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","changelog-backend.shelly.cloud","",""
|
||||
"cert_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","Ok via SAN and CN (works w/o SNI)","",""
|
||||
"cert_trust_wildcard","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","",""
|
||||
"cert_expirationStatus","changelog-backend.shelly.cloud/34.62.47.252","443","OK","46 >= 30 days","",""
|
||||
"cert_notBefore","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-09-21 09:03","",""
|
||||
"cert_notAfter","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2026-12-20 09:03","",""
|
||||
"cert_extlifeSpan","changelog-backend.shelly.cloud/34.62.47.252","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http://ye1.c.lencr.org/108.crl","",""
|
||||
"cert_ocspURL","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","",""
|
||||
"OCSP_stapling","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","",""
|
||||
"DNS_CAArecord","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","--","",""
|
||||
"certificate_transparency","changelog-backend.shelly.cloud/34.62.47.252","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","4","",""
|
||||
"certs_list_ordering_problem","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","",""
|
||||
"cert_caIssuers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07","",""
|
||||
"intermediate_cert_notBefore <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 <-- Root YE","",""
|
||||
"intermediate_cert <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0","",""
|
||||
"intermediate_cert_notBefore <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Root YE <-- ISRG Root X2","",""
|
||||
"intermediate_cert <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6","",""
|
||||
"intermediate_cert_notBefore <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ISRG Root X2 <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","changelog-backend.shelly.cloud/34.62.47.252","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","404 Not Found ('/')","",""
|
||||
"HTTP_clock_skew","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1793780149","",""
|
||||
"HSTS_time","changelog-backend.shelly.cloud/34.62.47.252","443","OK","180 days (=15552000 seconds) > 15552000 seconds","",""
|
||||
"HSTS_subdomains","changelog-backend.shelly.cloud/34.62.47.252","443","OK","includes subdomains","",""
|
||||
"HSTS_preload","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","domain is NOT marked for preloading","",""
|
||||
"HPKP","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||
"banner_application","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No application banner found","",""
|
||||
"cookie_count","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"X-Frame-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","SAMEORIGIN","",""
|
||||
"X-Content-Type-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","nosniff","",""
|
||||
"Content-Security-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","OK","default-src 'none'","",""
|
||||
"Cross-Origin-Opener-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","",""
|
||||
"Cross-Origin-Resource-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","",""
|
||||
"Cross-Origin-Embedder-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","require-corp","",""
|
||||
"X-XSS-Protection","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0","",""
|
||||
"Access-Control-Allow-Origin","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*","",""
|
||||
"Referrer-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no-referrer","",""
|
||||
"banner_reverseproxy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","","CWE-200"
|
||||
"heartbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","changelog-backend.shelly.cloud/34.62.47.252","443","MEDIUM","potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no RSA certificate, can't be used with SSLv2 elsewhere","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||
"winshock","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_X","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_11_12","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_13_14","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_15","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-ie_8_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_101_win10_21h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_7u25","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1102","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1703","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_2106","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-go_1178","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-libressl_336","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305","",""
|
||||
"clientsimulation-openssl_102e","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_315","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_350","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-thunderbird_91_9","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"rating_spec","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","",""
|
||||
"key_exchange_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","",""
|
||||
"key_exchange_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","",""
|
||||
"cipher_strength_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","36","",""
|
||||
"final_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","96","",""
|
||||
"overall_grade","changelog-backend.shelly.cloud/34.62.47.252","443","OK","A-","",""
|
||||
"grade_cap_warning_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS 1.3 is not supported","",""
|
||||
|
@@ -0,0 +1,224 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (34.62.47.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span>not offered and downgraded to a weaker protocol
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
<u>TLSv1.3</u>
|
||||
-
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||
<span style="color:#cd00cd;"> -- inconclusive test, matching cipher in list missing</span>, better see above
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||
ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">ECDSA with SHA384</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>EC <span style="color:#008817;">256</span> bits (curve P-256)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
|
||||
SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>changelog-backend.shelly.cloud </i> (CN in response to request w/o SNI: <i>*.shelly.cloud </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>changelog-backend.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (works w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">46 >= 30 days</span> (2026-09-21 09:03 --> 2026-12-20 09:03)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://ye1.c.lencr.org/108.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YE1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YE1</i> <-- <i>Root YE</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YE</i> <-- <i>ISRG Root X2</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>ISRG Root X2</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#008817;">180 days</span>=15552000 s<span style="color:#008817;">, includeSubDomains</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span><span style="color:#008817;">X-Frame-Options</span>: SAMEORIGIN
|
||||
<span style="color:#008817;">X-Content-Type-Options</span>: nosniff
|
||||
<span style="color:#008817;">Content-Security-Policy</span>: default-src 'none'
|
||||
Cross-Origin-Opener-Policy: same-origin
|
||||
Cross-Origin-Resource-Policy: same-origin
|
||||
Cross-Origin-Embedder-Policy: require-corp
|
||||
X-XSS-Protection: 0
|
||||
Access-Control-Allow-Origin: *
|
||||
Referrer-Policy: no-referrer
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#c05600;">potentially NOT ok, "gzip" HTTP compression detected.</span> - only supplied "/" tested
|
||||
Can be ignored for static pages or if no secrets in the page
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span> - ARIA, CHACHA or CCM ciphers found
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>96
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A-</span>
|
||||
<span style="font-weight:bold;"> Grade warning </span><span style="color:#c05600;">TLS 1.3 is not supported</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,785 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793780130",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "changelog-backend.shelly.cloud",
|
||||
"ip" : "34.62.47.252",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered + downgraded to weaker protocol"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca9",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02b",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a server cipher order configured"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no -- no lifetime advertised"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "cert_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "N/A"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "ECDSA with SHA384"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "OK",
|
||||
"finding" : "EC 256 bits (curve P-256)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0582918DB89B4A8A742D84FD104CDC41D76B"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2B1B2A1E33BDD140FA382D85F749503A2CEB16FD"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "changelog-backend.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "changelog-backend.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (works w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "46 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-09-21 09:03"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2026-12-20 09:03"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ye1.c.lencr.org/108.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YE1 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YE1 <-- Root YE"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YE <-- ISRG Root X2"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ISRG Root X2 <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "404 Not Found ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793780149"
|
||||
},{
|
||||
"id" : "HSTS_time",
|
||||
"severity" : "OK",
|
||||
"finding" : "180 days (=15552000 seconds) > 15552000 seconds"
|
||||
},{
|
||||
"id" : "HSTS_subdomains",
|
||||
"severity" : "OK",
|
||||
"finding" : "includes subdomains"
|
||||
},{
|
||||
"id" : "HSTS_preload",
|
||||
"severity" : "INFO",
|
||||
"finding" : "domain is NOT marked for preloading"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "X-Frame-Options",
|
||||
"severity" : "OK",
|
||||
"finding" : "SAMEORIGIN"
|
||||
},{
|
||||
"id" : "X-Content-Type-Options",
|
||||
"severity" : "OK",
|
||||
"finding" : "nosniff"
|
||||
},{
|
||||
"id" : "Content-Security-Policy",
|
||||
"severity" : "OK",
|
||||
"finding" : "default-src 'none'"
|
||||
},{
|
||||
"id" : "Cross-Origin-Opener-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "same-origin"
|
||||
},{
|
||||
"id" : "Cross-Origin-Resource-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "same-origin"
|
||||
},{
|
||||
"id" : "Cross-Origin-Embedder-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "require-corp"
|
||||
},{
|
||||
"id" : "X-XSS-Protection",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "Referrer-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no-referrer"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "no session ticket extension"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "MEDIUM",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no RSA certificate, can't be used with SSLv2 elsewhere"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "96"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A-"
|
||||
},{
|
||||
"id" : "grade_cap_warning_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS 1.3 is not supported"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 46
|
||||
}
|
||||
@@ -0,0 +1,203 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (34.62.47.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [mnot offered and downgraded to a weaker protocol
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
[4mTLSv1.3[m
|
||||
-
|
||||
|
||||
[1m Has server cipher order? [mno
|
||||
[0;35m -- inconclusive test, matching cipher in list missing[m, better see above
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||
ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m TLS 1.2 sig_algs offered: [mECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mECDSA with SHA384[m
|
||||
[1m Server key size [mEC [0;32m256[m bits (curve P-256)
|
||||
[1m Server key usage [mDigital Signature
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
|
||||
SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
[1m Common Name (CN) [m[3mchangelog-backend.shelly.cloud [m (CN in response to request w/o SNI: [3m*.shelly.cloud [m)
|
||||
[1m subjectAltName (SAN) [m[3mchangelog-backend.shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (works w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m46 >= 30 days[m (2026-09-21 09:03 --> 2026-12-20 09:03)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://ye1.c.lencr.org/108.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mYE1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYE1[m <-- [3mRoot YE[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YE[m <-- [3mISRG Root X2[m
|
||||
#3: [0;32mok > 40 days[m (2032-09-02 23:59). [3mISRG Root X2[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[0;32m180 days[m=15552000 s[0;32m, includeSubDomains[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
[1m Security headers [m[0;32mX-Frame-Options[m: SAMEORIGIN
|
||||
[0;32mX-Content-Type-Options[m: nosniff
|
||||
[0;32mContent-Security-Policy[m: default-src 'none'
|
||||
Cross-Origin-Opener-Policy: same-origin
|
||||
Cross-Origin-Resource-Policy: same-origin
|
||||
Cross-Origin-Embedder-Policy: require-corp
|
||||
X-XSS-Protection: 0
|
||||
Access-Control-Allow-Origin: *
|
||||
Referrer-Policy: no-referrer
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;33mpotentially NOT ok, "gzip" HTTP compression detected.[m - only supplied "/" tested
|
||||
Can be ignored for static pages or if no secrets in the page
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m - ARIA, CHACHA or CCM ciphers found
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 100 (30)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m96
|
||||
[1m Overall Grade [m[1;32mA-[m
|
||||
[1m Grade warning [m[0;33mTLS 1.3 is not supported[m
|
||||
|
||||
[7m Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,188 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","HTTP","",""
|
||||
"pre_128cipher","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","",""
|
||||
"SSLv3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","",""
|
||||
"TLS1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","",""
|
||||
"TLS1_1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","",""
|
||||
"TLS1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||
"TLS1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered with final","",""
|
||||
"NPN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","",""
|
||||
"ALPN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","",""
|
||||
"cipher-tls1_2_xc02f","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc027","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc028","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc061","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc060","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc014","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc09d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||
"cipher-tls1_2_xc051","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc09c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||
"cipher-tls1_2_xc050","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x3c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x2f","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","false","",""
|
||||
"cipher_order-tls1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","",""
|
||||
"cipher-tls1_3_x1302","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipherorder_TLSv1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"prioritize_chacha_TLSv1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","false","",""
|
||||
"cipher_order","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","",""
|
||||
"FS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||
"FS_ciphers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","X25519MLKEM768","",""
|
||||
"FS_ECDHE_curves","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"DH_groups","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ffdhe2048 ffdhe3072","",""
|
||||
"FS_TLS12_sig_algs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||
"FS_TLS13_sig_algs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||
"TLS_extensions","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","valid for 7200 seconds only (<daily)","",""
|
||||
"SSL_sessionID_support","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","supported","",""
|
||||
"sessionresumption_ID","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not supported","",""
|
||||
"TLS_timestamp","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","random","",""
|
||||
"certificate_compression","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","none","",""
|
||||
"clientAuth","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","none","",""
|
||||
"cert_numbers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","",""
|
||||
"cert_ocspURL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","not offered","",""
|
||||
"cert_mustStapleExtension","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","--","",""
|
||||
"certificate_transparency","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","no","",""
|
||||
"cert_caIssuers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","404 Not Found ('/')","",""
|
||||
"HTTP_clock_skew","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","1793779578","",""
|
||||
"HSTS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","not offered","",""
|
||||
"HPKP","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No Server banner line in header, interesting!","",""
|
||||
"banner_application","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No application banner found","",""
|
||||
"cookie_count","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*","",""
|
||||
"banner_reverseproxy","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","","CWE-200"
|
||||
"heartbleed","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_X","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_11_12","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_13_14","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_15","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-ie_8_win7","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_7u25","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1703","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-libressl_336","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_102e","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"rating_spec","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","30","",""
|
||||
"key_exchange_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","27","",""
|
||||
"cipher_strength_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","36","",""
|
||||
"final_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","93","",""
|
||||
"overall_grade","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","A+","",""
|
||||
|
@@ -0,0 +1,242 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:05:46 -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (34.79.5.199): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
<u>TLSv1.3</u> (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span> -- mitigated (disconnect after 4/10 attempts)
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:06:59 [ 75s] -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,841 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_101eu shelly-101-eu.shelly.cloud:31234",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793779544",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-101-eu.shelly.cloud",
|
||||
"ip" : "34.79.5.199",
|
||||
"port" : "31234",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc027",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc028",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc061",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc060",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc051",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc050",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3d",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3c",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "OK",
|
||||
"finding" : "X25519MLKEM768"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "DH_groups",
|
||||
"severity" : "OK",
|
||||
"finding" : "ffdhe2048 ffdhe3072"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "valid for 7200 seconds only (<daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "404 Not Found ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793779578"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No Server banner line in header, interesting!"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, mitigated"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 75
|
||||
}
|
||||
@@ -0,0 +1,221 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_101eu shelly-101-eu.shelly.cloud:31234"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:05:46 -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (34.79.5.199): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
[4mTLSv1.3[m (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[1;33mnot offered[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m -- mitigated (disconnect after 4/10 attempts)
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 09:06:59 [ 75s] -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,174 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","HTTP","",""
|
||||
"pre_128cipher","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","",""
|
||||
"SSLv3","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","",""
|
||||
"TLS1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||
"TLS1_1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||
"TLS1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||
"TLS1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered with final","",""
|
||||
"NPN","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||
"ALPN","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_2_xc030","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9f","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xccaa","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc02f","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9e","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||
"cipher_order-tls1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a server cipher order configured","",""
|
||||
"FS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||
"FS_ciphers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","prime256v1 secp384r1 X25519","",""
|
||||
"DH_groups","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ffdhe2048","",""
|
||||
"FS_TLS12_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224","",""
|
||||
"FS_TLS13_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no -- no lifetime advertised","",""
|
||||
"SSL_sessionID_support","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","supported","",""
|
||||
"TLS_timestamp","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","random","",""
|
||||
"certificate_compression","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","none","",""
|
||||
"clientAuth","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","none","",""
|
||||
"cert_numbers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","",""
|
||||
"cert_ocspURL","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||
"cert_ocspRevoked","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not revoked","",""
|
||||
"cert_mustStapleExtension","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","--","",""
|
||||
"certificate_transparency","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no","",""
|
||||
"cert_caIssuers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","401 Unauthorized ('/') --","",""
|
||||
"HTTP_clock_skew","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","1793778429","",""
|
||||
"HSTS","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","not offered","",""
|
||||
"HPKP","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||
"banner_application","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No application banner found","",""
|
||||
"cookie_count","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*","",""
|
||||
"banner_reverseproxy","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","","CWE-200"
|
||||
"heartbleed","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RFC7919/ffdhe2048","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","30","",""
|
||||
"key_exchange_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","27","",""
|
||||
"cipher_strength_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","36","",""
|
||||
"final_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","93","",""
|
||||
"overall_grade","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","A+","",""
|
||||
|
+229
@@ -0,0 +1,229 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:46:41 -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (104.155.32.247): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
x9f DHE-RSA-AES256-GCM-SHA384 DH<span style="color:#008817;"> 2048</span> AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xccaa DHE-RSA-CHACHA20-POLY1305 DH<span style="color:#008817;"> 2048</span> ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9e DHE-RSA-AES128-GCM-SHA256 DH<span style="color:#008817;"> 2048</span> AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||
(limited sense as client will pick)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||
DHE-RSA-AES128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> DH group offered: </span><span style="color:#008817;">ffdhe2048</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "status request/#5"
|
||||
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "supported versions/#43"
|
||||
"key share/#51" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#008817;">offered</span>, <span style="color:#008817;">not revoked</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 401 Unauthorized
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental common prime with 2048 bits detected: <i>RFC7919/ffdhe2048</i> (<span style="color:#008817;">2048 bits</span>),
|
||||
but no DH EXPORT ciphers
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||
IE 11 Win Phone 8.1 No connection
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:47:32 [ 53s] -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
+785
@@ -0,0 +1,785 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_120eu shelly-120-eu.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793778399",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-120-eu.shelly.cloud",
|
||||
"ip" : "104.155.32.247",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xccaa",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9e",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a server cipher order configured"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 X25519"
|
||||
},{
|
||||
"id" : "DH_groups",
|
||||
"severity" : "OK",
|
||||
"finding" : "ffdhe2048"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no -- no lifetime advertised"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cert_ocspRevoked",
|
||||
"severity" : "OK",
|
||||
"finding" : "not revoked"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "401 Unauthorized ('/') --"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793778429"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "no session ticket extension"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "RFC7919/ffdhe2048"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 53
|
||||
}
|
||||
@@ -0,0 +1,208 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_120eu shelly-120-eu.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:46:41 -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (104.155.32.247): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
x9f DHE-RSA-AES256-GCM-SHA384 DH[0;32m 2048[m AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xccaa DHE-RSA-CHACHA20-POLY1305 DH[0;32m 2048[m ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9e DHE-RSA-AES128-GCM-SHA256 DH[0;32m 2048[m AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [mno
|
||||
(limited sense as client will pick)
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||
DHE-RSA-AES128-GCM-SHA256
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32mX25519[m
|
||||
[1m DH group offered: [m[0;32mffdhe2048[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "status request/#5"
|
||||
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "supported versions/#43"
|
||||
"key share/#51" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: yes
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[0;32moffered[m, [0;32mnot revoked[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 401 Unauthorized
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental common prime with 2048 bits detected: [3mRFC7919/ffdhe2048[m ([0;32m2048 bits[m),
|
||||
but no DH EXPORT ciphers
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||
IE 11 Win Phone 8.1 No connection
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:47:32 [ 53s] -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
+177
@@ -0,0 +1,177 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-120-eu.shelly.cloud/104.155.32.247","6113","DEBUG","Couldn't determine service, skipping all HTTP checks","",""
|
||||
"pre_128cipher","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","",""
|
||||
"SSLv3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","",""
|
||||
"TLS1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","",""
|
||||
"TLS1_1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","",""
|
||||
"TLS1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||
"TLS1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered with final","",""
|
||||
"NPN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","",""
|
||||
"ALPN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","",""
|
||||
"cipher-tls1_2_xc02f","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc027","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc028","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc061","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc060","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc014","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc09d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||
"cipher-tls1_2_xc051","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc09c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||
"cipher-tls1_2_xc050","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x3c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x2f","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","false","",""
|
||||
"cipher_order-tls1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","",""
|
||||
"cipher-tls1_3_x1302","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipherorder_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"prioritize_chacha_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","false","",""
|
||||
"cipher_order","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","",""
|
||||
"FS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||
"FS_ciphers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","X25519MLKEM768","",""
|
||||
"FS_ECDHE_curves","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"DH_groups","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ffdhe2048 ffdhe3072","",""
|
||||
"FS_TLS12_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||
"FS_TLS13_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||
"TLS_extensions","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","valid for 7200 seconds only (<daily)","",""
|
||||
"SSL_sessionID_support","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","supported","",""
|
||||
"sessionresumption_ID","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not supported","",""
|
||||
"TLS_timestamp","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","random","",""
|
||||
"certificate_compression","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","none","",""
|
||||
"clientAuth","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","none","",""
|
||||
"cert_numbers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","--","",""
|
||||
"cert_ocspURL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","not offered","",""
|
||||
"cert_mustStapleExtension","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","--","",""
|
||||
"certificate_transparency","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","no","",""
|
||||
"cert_caIssuers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","intermediate certificate(s) is/are ok","",""
|
||||
"heartbleed","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-120-eu.shelly.cloud/104.155.32.247","6113","MEDIUM","VULNERABLE, potential DoS threat","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310"
|
||||
"POODLE_SSL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_X","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_11_12","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_13_14","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_15","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-ie_8_win7","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_7u25","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1703","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-libressl_336","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_102e","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"rating_spec","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","30","",""
|
||||
"key_exchange_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","27","",""
|
||||
"cipher_strength_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","36","",""
|
||||
"final_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","93","",""
|
||||
"overall_grade","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","A+","",""
|
||||
|
+229
@@ -0,0 +1,229 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:54:02 -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (104.155.32.247): --
|
||||
Service detected: Couldn't determine what's running on port 6113, assuming no HTTP service => skipping all HTTP checks
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
<u>TLSv1.3</u> (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#c05600;">VULNERABLE (NOT ok)</span>, potential DoS threat
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span> (not using HTTP anyway)
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
Could not determine the protocol, only simulating generic clients.
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:55:14 [ 73s] -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
+794
@@ -0,0 +1,794 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_120eu_6133 shelly-120-eu.shelly.cloud:6113",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793778841",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-120-eu.shelly.cloud",
|
||||
"ip" : "104.155.32.247",
|
||||
"port" : "6113",
|
||||
"rDNS" : "--",
|
||||
"service" : "Couldn't determine service, skipping all HTTP checks",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc027",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc028",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc061",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc060",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc051",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc050",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3d",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3c",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "OK",
|
||||
"finding" : "X25519MLKEM768"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "DH_groups",
|
||||
"severity" : "OK",
|
||||
"finding" : "ffdhe2048 ffdhe3072"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "valid for 7200 seconds only (<daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not applicable, not HTTP"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "MEDIUM",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "VULNERABLE, potential DoS threat"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable (not using HTTP anyway)"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 73
|
||||
}
|
||||
+208
@@ -0,0 +1,208 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_120eu_6133 shelly-120-eu.shelly.cloud:6113"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:54:02 -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (104.155.32.247): --
|
||||
Service detected: Couldn't determine what's running on port 6113, assuming no HTTP service => skipping all HTTP checks
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
[4mTLSv1.3[m (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[1;33mnot offered[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;33mVULNERABLE (NOT ok)[m, potential DoS threat
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m (not using HTTP anyway)
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
Could not determine the protocol, only simulating generic clients.
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:55:14 [ 73s] -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,166 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","control.shelly.cloud/34.95.90.149","443","INFO","HTTP","",""
|
||||
"pre_128cipher","control.shelly.cloud/34.95.90.149","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","control.shelly.cloud/34.95.90.149","443","OK","not offered","",""
|
||||
"SSLv3","control.shelly.cloud/34.95.90.149","443","OK","not offered","",""
|
||||
"TLS1","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||
"TLS1_1","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||
"TLS1_2","control.shelly.cloud/34.95.90.149","443","OK","offered","",""
|
||||
"TLS1_3","control.shelly.cloud/34.95.90.149","443","OK","offered with final","",""
|
||||
"NPN","control.shelly.cloud/34.95.90.149","443","INFO","offered with grpc-exp, h2, http/1.1, http/1.0 (advertised)","",""
|
||||
"ALPN_HTTP2","control.shelly.cloud/34.95.90.149","443","OK","h2","",""
|
||||
"ALPN","control.shelly.cloud/34.95.90.149","443","INFO","http/1.1grpc-exp","",""
|
||||
"cipherlist_NULL","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","control.shelly.cloud/34.95.90.149","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||
"cipherlist_STRONG_FS","control.shelly.cloud/34.95.90.149","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","control.shelly.cloud/34.95.90.149","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||
"cipher-tls1_2_xc02f","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xcca8","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc030","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc013","control.shelly.cloud/34.95.90.149","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc014","control.shelly.cloud/34.95.90.149","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","control.shelly.cloud/34.95.90.149","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","control.shelly.cloud/34.95.90.149","443","INFO","true","",""
|
||||
"cipher_order-tls1_3","control.shelly.cloud/34.95.90.149","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","control.shelly.cloud/34.95.90.149","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","control.shelly.cloud/34.95.90.149","443","OK","server -- TLS 1.3 client determined","",""
|
||||
"FS","control.shelly.cloud/34.95.90.149","443","OK","offered","",""
|
||||
"FS_ciphers","control.shelly.cloud/34.95.90.149","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||
"FS_KEMs","control.shelly.cloud/34.95.90.149","443","OK","X25519MLKEM768","",""
|
||||
"FS_ECDHE_curves","control.shelly.cloud/34.95.90.149","443","OK","prime256v1 secp384r1 X25519","",""
|
||||
"FS_TLS12_sig_algs","control.shelly.cloud/34.95.90.149","443","LOW","RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1","",""
|
||||
"FS_TLS13_sig_algs","control.shelly.cloud/34.95.90.149","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||
"TLS_extensions","control.shelly.cloud/34.95.90.149","443","INFO","'server name/#0' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'next protocol/#13172' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","control.shelly.cloud/34.95.90.149","443","LOW","valid for 100800 seconds (>daily)","",""
|
||||
"SSL_sessionID_support","control.shelly.cloud/34.95.90.149","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","control.shelly.cloud/34.95.90.149","443","INFO","supported","",""
|
||||
"sessionresumption_ID","control.shelly.cloud/34.95.90.149","443","INFO","not supported","",""
|
||||
"TLS_timestamp","control.shelly.cloud/34.95.90.149","443","INFO","random","",""
|
||||
"certificate_compression","control.shelly.cloud/34.95.90.149","443","INFO","none","",""
|
||||
"clientAuth","control.shelly.cloud/34.95.90.149","443","INFO","none","",""
|
||||
"cert_numbers","control.shelly.cloud/34.95.90.149","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","control.shelly.cloud/34.95.90.149","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","control.shelly.cloud/34.95.90.149","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","control.shelly.cloud/34.95.90.149","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","control.shelly.cloud/34.95.90.149","443","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","control.shelly.cloud/34.95.90.149","443","INFO","FBD73E92DBE13DC80A3FB4DD63E368DB","",""
|
||||
"cert_serialNumberLen","control.shelly.cloud/34.95.90.149","443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","control.shelly.cloud/34.95.90.149","443","INFO","37515BC1C73B336535ED37F1CD9278384F9E0E98","",""
|
||||
"cert_fingerprintSHA256","control.shelly.cloud/34.95.90.149","443","INFO","6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3","",""
|
||||
"cert","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFFDCCA/ygAwIBAgIRAPvXPpLb4T3ICj+03WPjaNswDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoGA1UEAxMDV1IzMB4XDTI2MTAxODIzNDQ1NVoXDTI3MDExNzAwMzkyOVowHzEdMBsGA1UEAxMUY29udHJvbC5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbUihR957TsP8TL3V6Rqlf3ncgnYgSEFXgWjPhzlCCkOW3dyhfvXT+cJsF+8/CDVji0Os5PKmWijlL0mcv6iXzw4Oqls1yayq6mVLBpXLoqCvR5WtSGoceEFhELIPSBvhvGlXsab5gCkG+wIBkfelZT5A3oSpRUAVENz4sZN+Y1/4+iS2E+CDxRtVvuZrWKM90ZlCqjFeGvWb6FpMUfjse+1OHBxK53KIosggb/QECKuZFW+8pdo76aYkZyn6dKvlKK2LAL0O3bbRbj1TY79KYQ8CiUS5GGlaXsyFKnYht+el6jvLESoARAZLskdh+/6lPrBMjhlwN//D+iDEQ4HNhAgMBAAGjggItMIICKTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4VYfOqiY+fz7YO1R/DF8usWFNNowHwYDVR0jBBgwFoAUx4H1/Y6I2QA8TWOiUDEkoM4j/iMwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjMuY3J0MB8GA1UdEQQYMBaCFGNvbnRyb2wuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dyMy9IZUxMSkNnTHhoRS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaFRnmDgAAAEAwBHMEUCIEz7/8a+28tg2XIrDGjAS44EUvcbPZRSl6m1SVexCJG3AiEAkGPO4c9doniOhqoRz6e12hzO3QfDa8TAkpRdoBJ4DooAfwCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAaFRnmIUAAgAAAUAJ8ClvwQDAEgwRgIhAKSCz56h72qUgBghlI5rkkWcKAMfikzxU1Effie8NKK1AiEAt7xx/ZGBjLkPeM2ZkBEhaAJVRE1/w8h9x2JSsXfeMxIwDQYJKoZIhvcNAQELBQADggEBACpCa22KEenOoelJMLIhBihS5B++QtjVmhIO/dSKv1Qmj+LiIIUcvnS0MKgM8sxfpOwTkoinCtGrAnZn6pMpTbG6OMaa3EIOY1kxYhFhQ9XeVMpwwW/l/DU+jcGDr33pMixBFCscyO4rt4ljQmT/59MR3TVA8mPSqLJy0wHhEKXbthmliuiiR0CGABYMsi9u7Cc0MpmIZ94/GeHM0uMGmMf4A87Qa4k7niL5xOn09poZ5YGh9tZcffqUvO1IAVrdo6ZhRCCNl5z+nP1aDqXUtlk51tnt6Mn7OqXSAN8Mby8G7asj4jG1HVXMyQGfa5aGYtAyezLgBsXxdLnj4lq8xgY=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","control.shelly.cloud/34.95.90.149","443","OK","control.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","control.shelly.cloud/34.95.90.149","443","INFO","control.shelly.cloud","",""
|
||||
"cert_subjectAltName","control.shelly.cloud/34.95.90.149","443","INFO","control.shelly.cloud","",""
|
||||
"cert_trust","control.shelly.cloud/34.95.90.149","443","OK","Ok via SAN and CN (same w/o SNI)","",""
|
||||
"cert_chain_of_trust","control.shelly.cloud/34.95.90.149","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","control.shelly.cloud/34.95.90.149","443","INFO","no","",""
|
||||
"cert_expirationStatus","control.shelly.cloud/34.95.90.149","443","OK","73 >= 60 days","",""
|
||||
"cert_notBefore","control.shelly.cloud/34.95.90.149","443","INFO","2026-10-18 23:44","",""
|
||||
"cert_notAfter","control.shelly.cloud/34.95.90.149","443","OK","2027-01-17 00:39","",""
|
||||
"cert_extlifeSpan","control.shelly.cloud/34.95.90.149","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","control.shelly.cloud/34.95.90.149","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","control.shelly.cloud/34.95.90.149","443","INFO","http://c.pki.goog/wr3/HeLLJCgLxhE.crl","",""
|
||||
"cert_ocspURL","control.shelly.cloud/34.95.90.149","443","INFO","--","",""
|
||||
"OCSP_stapling","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","control.shelly.cloud/34.95.90.149","443","INFO","--","",""
|
||||
"DNS_CAArecord","control.shelly.cloud/34.95.90.149","443","LOW","--","",""
|
||||
"certificate_transparency","control.shelly.cloud/34.95.90.149","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","control.shelly.cloud/34.95.90.149","443","INFO","3","",""
|
||||
"certs_list_ordering_problem","control.shelly.cloud/34.95.90.149","443","INFO","no","",""
|
||||
"cert_caIssuers","control.shelly.cloud/34.95.90.149","443","INFO","WR3 (Google Trust Services from US)","",""
|
||||
"intermediate_cert <#1>","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCzCCAvOgAwIBAgIQf/AFqRVo1jq8IoYWhKpLWjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPNHWHr4RyFI0HEJFvA6zx1Ag1mhnymxiJNGyYj3rU3eoF6N4bfIxUErp5ivsYDQ18nPO9OOSoXsYzy0aJb0ag6TdjjdzM1ZdOMq17HSMFufV7SUOY0LxXx1N4GLHtp1SyfIa+8FRFvIe6mVkd9LjbAPuBT0YrYl6xOqUqFyOsor7FjuVe/XEefaS0I30EUrI00t+ZrIfGTFlf+OZPjnWSwrIwRpLQtg3H5Iln/z9UlCdl4wHISiyEL2Vfza1c/aatQVvcTD8XlpF9qdg8Uyoc0ObUd+ZDSsK3+Eiiza1jtSVrlnIdgUVvhmnE5OZ4TDHmoX+nAXMKh++HiXLM08WNAgMBAAGjgf4wgfswDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHgfX9jojZADxNY6JQMSSgziP+IzAfBgNVHSMEGDAWgBTkrysmcRorSCeFL1JmLO/wiRNxPjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAKGGGh0dHA6Ly9pLnBraS5nb29nL3IxLmNydDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vYy5wa2kuZ29vZy9yL3IxLmNybDATBgNVHSAEDDAKMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAgEAnI1DlJQzSKcWbyXXrJSsgKMo6KG74TMqhsuTg67a0FX02752+eiJb5YsOJc8DVOHalwpOvbuPdl5BuAEgIK4Va7l9j3J9M1/EjeWjGTM3RoszmBJGu82oz6EWi5q75xeF+onJmh2Hm98a/yJAI/mODXq5LofYcQ9AffKP9ZMZu+YwW+/qHqyX2JhaOntvl7i8S+l1Y8CcKEqM1NFK4s4EBYPRFjZDawOHX7fSchbSMVPn5Nu04lrU6xufuZqRosEQw2o0UAyzDoyA52NXzJTWr1G2FVg/0A9hdrQ/6fe9G3167zKxNqXErs6MpHttEouGbpm2ftzrmcvruYxTfxc4G2GwBi3LFLozNpy042gDfXBzDyn1staWsy7+QnzMlR59Fz6jBOk5R4LT+ma0+KjnfRhMh5T2ucm69HkvNQtDZlVa1tLUlzs0zLEdQSehTCjZ6SYsGt2bMVK6dvtxzcyCP0QDUFnNXCwgw12+mGSkAuj4ORi8kMRpnL8UEjkNbdw9KL1eYbEC3D0GPue2Yk2AGhxkmcdm1BoOp05kYw/Nnqgh7QV8DKyBTUHbjH0pXlLiOsSOY+CLh1eTM+Do6rSjqGnDQeUXylZmPCmuveaw38IVnBaa6Eiz6pngZ1u6OeO/1UzfhmyTm0n0G+9JZ3KS2Mq08isNgXHLnhlHJaphpE=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","control.shelly.cloud/34.95.90.149","443","INFO","2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7","",""
|
||||
"intermediate_cert_notBefore <#1>","control.shelly.cloud/34.95.90.149","443","INFO","2023-12-13 09:00","",""
|
||||
"intermediate_cert_notAfter <#1>","control.shelly.cloud/34.95.90.149","443","OK","2029-02-20 14:00","",""
|
||||
"intermediate_cert_expiration <#1>","control.shelly.cloud/34.95.90.149","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","control.shelly.cloud/34.95.90.149","443","INFO","WR3 <-- GTS Root R1","",""
|
||||
"intermediate_cert <#2>","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFYjCCBEqgAwIBAgIQd70NbNs2+RrqIQ/E8FjTDTANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UECxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIwMDYxOTAwMDA0MloXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFIxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAthECix7joXebO9y/lD63ladAPKH9gvl9MgaCcfb2jH/76Nu8ai6Xl6OMS/kr9rH5zoQdsfnFl97vufKj6bwSiV6nqlKr+CMny6SxnGPb15l+8Ape62im9MZaRw1NEDPjTrETo8gYbEvs/AmQ351kKSUjB6G00j0uYODP0gmHu81I8E3CwnqIiru6z1kZ1q+PsAewnjHxgsHA3y6mbWwZDrXYfiYaRQM9sHmklCitD38m5agI/pboPGiUU+6DOogrFZYJsuB6jC511pzrp1Zkj5ZPaK49l8KEj8C8QMALXL32h7M1bKwYUH+E4EzNktMg6TO8UpmvMrUpsyUqtEj5cuHKZPfmghCN6J3Cioj6OGaK/GP5Afl4/Xtcd/p2h/rs37EOeZVXtL0m79YB0esWCruOC7XFxYpVq9Os6pFLKcwZpDIlTirxZUTQAs6qzkm06p98g7BAe+dDq6dso499iYH6TKX/1Y7DzkvgtdizjkXPdsDtQCv9Uw+wp9U7DbGKogPeMa3Md+pvez7W35EiEua++tgy/BBjFFFy3l3WFpO9KWgz7zpm7AeKJt8T11dleCfeXkkUAKIAf5qoIbapsZWwpbkNFhHax2xIPEDgfg1azVY80ZcFuctL7TlLnMQ/0lUTbiSw1nH69MG6zO0b9f6BQdgAmD06yK56mDcYBZUCAwEAAaOCATgwggE0MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTkrysmcRorSCeFL1JmLO/wiRNxPjAfBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzBgBggrBgEFBQcBAQRUMFIwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnBraS5nb29nL2dzcjEwKQYIKwYBBQUHMAKGHWh0dHA6Ly9wa2kuZ29vZy9nc3IxL2dzcjEuY3J0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwucGtpLmdvb2cvZ3NyMS9nc3IxLmNybDA7BgNVHSAENDAyMAgGBmeBDAECATAIBgZngQwBAgIwDQYLKwYBBAHWeQIFAwIwDQYLKwYBBAHWeQIFAwMwDQYJKoZIhvcNAQELBQADggEBADSkHrEoo9C0dhemMXoh6dFSPsjbdBZBiLg9NR3t5P+T4Vxfq7vqfM/b5A3Ri1fyJm9bvhdGaJQ3b2t6yMAYN/olUazsaL+yyEn9WprKASOshIArAoyZl+tJaox118fessmXn1hIVw41oeQa1v1vg4Fv74zPl6/AhSrw9U5pCZEt4Wi4wStz6dTZ/CLANx8LZh1J7QJVj2fhMtfTJr9w4z30Z209fOU0iOMy+qduBmpvvYuR7hZL6Dupszfnw0Skfths18dG9ZKb59UhvmaSGZRVbNQpsg3BZlvid0lIKO2d1xozclOzgjXPYovJJIultzkMu34qQb9Sz/yilrbCgj8=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","control.shelly.cloud/34.95.90.149","443","INFO","3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5","",""
|
||||
"intermediate_cert_notBefore <#2>","control.shelly.cloud/34.95.90.149","443","INFO","2020-06-19 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","control.shelly.cloud/34.95.90.149","443","OK","2028-01-28 00:00","",""
|
||||
"intermediate_cert_expiration <#2>","control.shelly.cloud/34.95.90.149","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","control.shelly.cloud/34.95.90.149","443","INFO","GTS Root R1 <-- GlobalSign Root CA","",""
|
||||
"intermediate_cert_badOCSP","control.shelly.cloud/34.95.90.149","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","control.shelly.cloud/34.95.90.149","443","INFO","200 OK ('/')","",""
|
||||
"HTTP_clock_skew","control.shelly.cloud/34.95.90.149","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","control.shelly.cloud/34.95.90.149","443","INFO","1793778057","",""
|
||||
"HSTS","control.shelly.cloud/34.95.90.149","443","LOW","not offered","",""
|
||||
"HPKP","control.shelly.cloud/34.95.90.149","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","control.shelly.cloud/34.95.90.149","443","INFO","UploadServer","",""
|
||||
"banner_application","control.shelly.cloud/34.95.90.149","443","INFO","No application banner found","",""
|
||||
"cookie_count","control.shelly.cloud/34.95.90.149","443","INFO","0 at '/'","",""
|
||||
"Cache-Control","control.shelly.cloud/34.95.90.149","443","INFO","no-transform, private, no-cache, no-store, must-revalidate, max-age=0","",""
|
||||
"banner_reverseproxy","control.shelly.cloud/34.95.90.149","443","INFO","--","","CWE-200"
|
||||
"heartbleed","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","control.shelly.cloud/34.95.90.149","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","control.shelly.cloud/34.95.90.149","443","MEDIUM","potentially VULNERABLE, gzip deflate compress br HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","control.shelly.cloud/34.95.90.149","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","control.shelly.cloud/34.95.90.149","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","control.shelly.cloud/34.95.90.149","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","control.shelly.cloud/34.95.90.149","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","control.shelly.cloud/34.95.90.149","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_winphone81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","control.shelly.cloud/34.95.90.149","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-java_1703","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","control.shelly.cloud/34.95.90.149","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","control.shelly.cloud/34.95.90.149","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","control.shelly.cloud/34.95.90.149","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","30","",""
|
||||
"key_exchange_score","control.shelly.cloud/34.95.90.149","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","27","",""
|
||||
"cipher_strength_score","control.shelly.cloud/34.95.90.149","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","36","",""
|
||||
"final_score","control.shelly.cloud/34.95.90.149","443","INFO","93","",""
|
||||
"overall_grade","control.shelly.cloud/34.95.90.149","443","OK","A+","",""
|
||||
|
@@ -0,0 +1,225 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:40:32 -->> 34.95.90.149:443 (control.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (34.95.90.149): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>grpc-exp, h2, http/1.1, http/1.0 (advertised)
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1, grpc-exp (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384
|
||||
RSA-PSS-RSAE+SHA512 RSA+SHA512 <span style="color:#a86437;">RSA+SHA1</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "next protocol/#13172"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>100800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>FBD73E92DBE13DC80A3FB4DD63E368DB (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 37515BC1C73B336535ED37F1CD9278384F9E0E98
|
||||
SHA256 6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>control.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>control.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (same w/o SNI)
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">73 >= 60 days</span> (2026-10-18 23:44 --> 2027-01-17 00:39)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://c.pki.goog/wr3/HeLLJCgLxhE.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||
<span style="font-weight:bold;"> Issuer </span><i>WR3</i> (<i>Google Trust Services</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2029-02-20 14:00). <i>WR3</i> <-- <i>GTS Root R1</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2028-01-28 00:00). <i>GTS Root R1</i> <-- <i>GlobalSign Root CA</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 200 OK
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>UploadServer'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/")
|
||||
<span style="font-weight:bold;"> Security headers </span>Cache-Control: no-transform, private, no-cache, no-store,
|
||||
must-revalidate, max-age=0
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#c05600;">potentially NOT ok, "gzip deflate compress br" HTTP compression detected.</span> - only supplied "/" tested
|
||||
Can be ignored for static pages or if no secrets in the page
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:41:24 [ 53s] -->> 34.95.90.149:443 (control.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,753 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_control control.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793778031",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "control.shelly.cloud",
|
||||
"ip" : "34.95.90.149",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "offered with grpc-exp, h2, http/1.1, http/1.0 (advertised)"
|
||||
},{
|
||||
"id" : "ALPN_HTTP2",
|
||||
"severity" : "OK",
|
||||
"finding" : "h2"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1grpc-exp"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "true"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- TLS 1.3 client determined"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "OK",
|
||||
"finding" : "X25519MLKEM768"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 X25519"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'next protocol/#13172' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "LOW",
|
||||
"finding" : "valid for 100800 seconds (>daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "FBD73E92DBE13DC80A3FB4DD63E368DB"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "37515BC1C73B336535ED37F1CD9278384F9E0E98"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFFDCCA/ygAwIBAgIRAPvXPpLb4T3ICj+03WPjaNswDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoGA1UEAxMDV1IzMB4XDTI2MTAxODIzNDQ1NVoXDTI3MDExNzAwMzkyOVowHzEdMBsGA1UEAxMUY29udHJvbC5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbUihR957TsP8TL3V6Rqlf3ncgnYgSEFXgWjPhzlCCkOW3dyhfvXT+cJsF+8/CDVji0Os5PKmWijlL0mcv6iXzw4Oqls1yayq6mVLBpXLoqCvR5WtSGoceEFhELIPSBvhvGlXsab5gCkG+wIBkfelZT5A3oSpRUAVENz4sZN+Y1/4+iS2E+CDxRtVvuZrWKM90ZlCqjFeGvWb6FpMUfjse+1OHBxK53KIosggb/QECKuZFW+8pdo76aYkZyn6dKvlKK2LAL0O3bbRbj1TY79KYQ8CiUS5GGlaXsyFKnYht+el6jvLESoARAZLskdh+/6lPrBMjhlwN//D+iDEQ4HNhAgMBAAGjggItMIICKTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4VYfOqiY+fz7YO1R/DF8usWFNNowHwYDVR0jBBgwFoAUx4H1/Y6I2QA8TWOiUDEkoM4j/iMwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjMuY3J0MB8GA1UdEQQYMBaCFGNvbnRyb2wuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dyMy9IZUxMSkNnTHhoRS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaFRnmDgAAAEAwBHMEUCIEz7/8a+28tg2XIrDGjAS44EUvcbPZRSl6m1SVexCJG3AiEAkGPO4c9doniOhqoRz6e12hzO3QfDa8TAkpRdoBJ4DooAfwCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAaFRnmIUAAgAAAUAJ8ClvwQDAEgwRgIhAKSCz56h72qUgBghlI5rkkWcKAMfikzxU1Effie8NKK1AiEAt7xx/ZGBjLkPeM2ZkBEhaAJVRE1/w8h9x2JSsXfeMxIwDQYJKoZIhvcNAQELBQADggEBACpCa22KEenOoelJMLIhBihS5B++QtjVmhIO/dSKv1Qmj+LiIIUcvnS0MKgM8sxfpOwTkoinCtGrAnZn6pMpTbG6OMaa3EIOY1kxYhFhQ9XeVMpwwW/l/DU+jcGDr33pMixBFCscyO4rt4ljQmT/59MR3TVA8mPSqLJy0wHhEKXbthmliuiiR0CGABYMsi9u7Cc0MpmIZ94/GeHM0uMGmMf4A87Qa4k7niL5xOn09poZ5YGh9tZcffqUvO1IAVrdo6ZhRCCNl5z+nP1aDqXUtlk51tnt6Mn7OqXSAN8Mby8G7asj4jG1HVXMyQGfa5aGYtAyezLgBsXxdLnj4lq8xgY=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "control.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "control.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "control.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "73 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-10-18 23:44"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-17 00:39"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://c.pki.goog/wr3/HeLLJCgLxhE.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "WR3 (Google Trust Services from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFCzCCAvOgAwIBAgIQf/AFqRVo1jq8IoYWhKpLWjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPNHWHr4RyFI0HEJFvA6zx1Ag1mhnymxiJNGyYj3rU3eoF6N4bfIxUErp5ivsYDQ18nPO9OOSoXsYzy0aJb0ag6TdjjdzM1ZdOMq17HSMFufV7SUOY0LxXx1N4GLHtp1SyfIa+8FRFvIe6mVkd9LjbAPuBT0YrYl6xOqUqFyOsor7FjuVe/XEefaS0I30EUrI00t+ZrIfGTFlf+OZPjnWSwrIwRpLQtg3H5Iln/z9UlCdl4wHISiyEL2Vfza1c/aatQVvcTD8XlpF9qdg8Uyoc0ObUd+ZDSsK3+Eiiza1jtSVrlnIdgUVvhmnE5OZ4TDHmoX+nAXMKh++HiXLM08WNAgMBAAGjgf4wgfswDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHgfX9jojZADxNY6JQMSSgziP+IzAfBgNVHSMEGDAWgBTkrysmcRorSCeFL1JmLO/wiRNxPjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAKGGGh0dHA6Ly9pLnBraS5nb29nL3IxLmNydDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vYy5wa2kuZ29vZy9yL3IxLmNybDATBgNVHSAEDDAKMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAgEAnI1DlJQzSKcWbyXXrJSsgKMo6KG74TMqhsuTg67a0FX02752+eiJb5YsOJc8DVOHalwpOvbuPdl5BuAEgIK4Va7l9j3J9M1/EjeWjGTM3RoszmBJGu82oz6EWi5q75xeF+onJmh2Hm98a/yJAI/mODXq5LofYcQ9AffKP9ZMZu+YwW+/qHqyX2JhaOntvl7i8S+l1Y8CcKEqM1NFK4s4EBYPRFjZDawOHX7fSchbSMVPn5Nu04lrU6xufuZqRosEQw2o0UAyzDoyA52NXzJTWr1G2FVg/0A9hdrQ/6fe9G3167zKxNqXErs6MpHttEouGbpm2ftzrmcvruYxTfxc4G2GwBi3LFLozNpy042gDfXBzDyn1staWsy7+QnzMlR59Fz6jBOk5R4LT+ma0+KjnfRhMh5T2ucm69HkvNQtDZlVa1tLUlzs0zLEdQSehTCjZ6SYsGt2bMVK6dvtxzcyCP0QDUFnNXCwgw12+mGSkAuj4ORi8kMRpnL8UEjkNbdw9KL1eYbEC3D0GPue2Yk2AGhxkmcdm1BoOp05kYw/Nnqgh7QV8DKyBTUHbjH0pXlLiOsSOY+CLh1eTM+Do6rSjqGnDQeUXylZmPCmuveaw38IVnBaa6Eiz6pngZ1u6OeO/1UzfhmyTm0n0G+9JZ3KS2Mq08isNgXHLnhlHJaphpE=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2023-12-13 09:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2029-02-20 14:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "WR3 <-- GTS Root R1"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFYjCCBEqgAwIBAgIQd70NbNs2+RrqIQ/E8FjTDTANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UECxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIwMDYxOTAwMDA0MloXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFIxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAthECix7joXebO9y/lD63ladAPKH9gvl9MgaCcfb2jH/76Nu8ai6Xl6OMS/kr9rH5zoQdsfnFl97vufKj6bwSiV6nqlKr+CMny6SxnGPb15l+8Ape62im9MZaRw1NEDPjTrETo8gYbEvs/AmQ351kKSUjB6G00j0uYODP0gmHu81I8E3CwnqIiru6z1kZ1q+PsAewnjHxgsHA3y6mbWwZDrXYfiYaRQM9sHmklCitD38m5agI/pboPGiUU+6DOogrFZYJsuB6jC511pzrp1Zkj5ZPaK49l8KEj8C8QMALXL32h7M1bKwYUH+E4EzNktMg6TO8UpmvMrUpsyUqtEj5cuHKZPfmghCN6J3Cioj6OGaK/GP5Afl4/Xtcd/p2h/rs37EOeZVXtL0m79YB0esWCruOC7XFxYpVq9Os6pFLKcwZpDIlTirxZUTQAs6qzkm06p98g7BAe+dDq6dso499iYH6TKX/1Y7DzkvgtdizjkXPdsDtQCv9Uw+wp9U7DbGKogPeMa3Md+pvez7W35EiEua++tgy/BBjFFFy3l3WFpO9KWgz7zpm7AeKJt8T11dleCfeXkkUAKIAf5qoIbapsZWwpbkNFhHax2xIPEDgfg1azVY80ZcFuctL7TlLnMQ/0lUTbiSw1nH69MG6zO0b9f6BQdgAmD06yK56mDcYBZUCAwEAAaOCATgwggE0MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTkrysmcRorSCeFL1JmLO/wiRNxPjAfBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzBgBggrBgEFBQcBAQRUMFIwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnBraS5nb29nL2dzcjEwKQYIKwYBBQUHMAKGHWh0dHA6Ly9wa2kuZ29vZy9nc3IxL2dzcjEuY3J0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwucGtpLmdvb2cvZ3NyMS9nc3IxLmNybDA7BgNVHSAENDAyMAgGBmeBDAECATAIBgZngQwBAgIwDQYLKwYBBAHWeQIFAwIwDQYLKwYBBAHWeQIFAwMwDQYJKoZIhvcNAQELBQADggEBADSkHrEoo9C0dhemMXoh6dFSPsjbdBZBiLg9NR3t5P+T4Vxfq7vqfM/b5A3Ri1fyJm9bvhdGaJQ3b2t6yMAYN/olUazsaL+yyEn9WprKASOshIArAoyZl+tJaox118fessmXn1hIVw41oeQa1v1vg4Fv74zPl6/AhSrw9U5pCZEt4Wi4wStz6dTZ/CLANx8LZh1J7QJVj2fhMtfTJr9w4z30Z209fOU0iOMy+qduBmpvvYuR7hZL6Dupszfnw0Skfths18dG9ZKb59UhvmaSGZRVbNQpsg3BZlvid0lIKO2d1xozclOzgjXPYovJJIultzkMu34qQb9Sz/yilrbCgj8=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2020-06-19 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-01-28 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "GTS Root R1 <-- GlobalSign Root CA"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "200 OK ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793778057"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "UploadServer"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/'"
|
||||
},{
|
||||
"id" : "Cache-Control",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no-transform, private, no-cache, no-store, must-revalidate, max-age=0"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "MEDIUM",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially VULNERABLE, gzip deflate compress br HTTP compression detected - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 53
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_control control.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:40:32 -->> 34.95.90.149:443 (control.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (34.95.90.149): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mgrpc-exp, h2, http/1.1, http/1.0 (advertised)
|
||||
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1, grpc-exp (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32mX25519[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384
|
||||
RSA-PSS-RSAE+SHA512 RSA+SHA512 [1;33mRSA+SHA1[m
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "next protocol/#13172"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m100800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [mFBD73E92DBE13DC80A3FB4DD63E368DB (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 37515BC1C73B336535ED37F1CD9278384F9E0E98
|
||||
SHA256 6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
|
||||
[1m Common Name (CN) [m[3mcontrol.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3mcontrol.shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (same w/o SNI)
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m73 >= 60 days[m (2026-10-18 23:44 --> 2027-01-17 00:39)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://c.pki.goog/wr3/HeLLJCgLxhE.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 3
|
||||
[1m Issuer [m[3mWR3[m ([3mGoogle Trust Services[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2029-02-20 14:00). [3mWR3[m <-- [3mGTS Root R1[m
|
||||
#2: [0;32mok > 40 days[m (2028-01-28 00:00). [3mGTS Root R1[m <-- [3mGlobalSign Root CA[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 200 OK
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mUploadServer
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/")
|
||||
[1m Security headers [mCache-Control: no-transform, private, no-cache, no-store,
|
||||
must-revalidate, max-age=0
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;33mpotentially NOT ok, "gzip deflate compress br" HTTP compression detected.[m - only supplied "/" tested
|
||||
Can be ignored for static pages or if no secrets in the page
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:41:24 [ 53s] -->> 34.95.90.149:443 (control.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,189 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","HTTP","",""
|
||||
"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","",""
|
||||
"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","",""
|
||||
"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||
"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||
"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered + downgraded to weaker protocol","",""
|
||||
"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||
"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","",""
|
||||
"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xc077","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc076","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc0a1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8","",""
|
||||
"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||
"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc0a0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8","",""
|
||||
"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||
"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xba","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x84","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x41","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","false","",""
|
||||
"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","",""
|
||||
"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||
"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","valid for 300 seconds only (<daily)","",""
|
||||
"SSL_sessionID_support","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","supported","",""
|
||||
"sessionresumption_ID","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not supported","",""
|
||||
"TLS_timestamp","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","random","",""
|
||||
"cert_compression","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","N/A","",""
|
||||
"clientAuth","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","none","",""
|
||||
"cert_numbers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","",""
|
||||
"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","",""
|
||||
"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","--","",""
|
||||
"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","",""
|
||||
"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","WARN","Unexpected 500 Internal Server Error @ '/'","",""
|
||||
"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1793779728","",""
|
||||
"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","",""
|
||||
"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||
"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No application banner found","",""
|
||||
"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*","",""
|
||||
"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","","CWE-200"
|
||||
"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","30","",""
|
||||
"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","27","",""
|
||||
"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","36","",""
|
||||
"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","93","",""
|
||||
"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","A-","",""
|
||||
"grade_cap_warning_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS 1.3 is not supported","",""
|
||||
|
@@ -0,0 +1,246 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span>not offered and downgraded to a weaker protocol
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH<span style="color:#008817;"> 253</span> Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH<span style="color:#008817;"> 253</span> Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
<u>TLSv1.3</u>
|
||||
-
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
|
||||
ECDHE-ARIA128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>300 seconds, session tickets keys seems to be rotated < daily
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 500 Internal Server Error<span style="color:#cd00cd;">. Oh, didn't expect "500 Internal Server Error"</span>
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 500 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span> - ARIA, CHACHA or CCM ciphers found
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A-</span>
|
||||
<span style="font-weight:bold;"> Grade warning </span><span style="color:#c05600;">TLS 1.3 is not supported</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,845 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793779704",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-infra1-eu.shelly.cloud",
|
||||
"ip" : "35.205.173.252",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered + downgraded to weaker protocol"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc061",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc060",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc028",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc077",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc027",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc076",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc0a1",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc051",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc0a0",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc050",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3d",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc0",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3c",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xba",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x84",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x41",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "valid for 300 seconds only (<daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "cert_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "N/A"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "WARN",
|
||||
"finding" : "Unexpected 500 Internal Server Error @ '/'"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793779728"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A-"
|
||||
},{
|
||||
"id" : "grade_cap_warning_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS 1.3 is not supported"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 64
|
||||
}
|
||||
@@ -0,0 +1,225 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [mnot offered and downgraded to a weaker protocol
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH[0;32m 253[m Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH[0;32m 253[m Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
[4mTLSv1.3[m
|
||||
-
|
||||
|
||||
[1m Has server cipher order? [m[1;32myes (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
|
||||
ECDHE-ARIA128-GCM-SHA256
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m300 seconds, session tickets keys seems to be rotated < daily
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[1;33mnot offered[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 500 Internal Server Error[0;35m. Oh, didn't expect "500 Internal Server Error"[m
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 500 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m - ARIA, CHACHA or CCM ciphers found
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA-[m
|
||||
[1m Grade warning [m[0;33mTLS 1.3 is not supported[m
|
||||
|
||||
[7m Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,188 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","HTTP","",""
|
||||
"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","",""
|
||||
"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","",""
|
||||
"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||
"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||
"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered with final","",""
|
||||
"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||
"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||
"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||
"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||
"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","",""
|
||||
"cipher_order-tls1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||
"cipher-tls1_3_x1302","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipherorder_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"prioritize_chacha_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","",""
|
||||
"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||
"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","X25519MLKEM768","",""
|
||||
"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"DH_groups","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ffdhe2048 ffdhe3072","",""
|
||||
"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||
"FS_TLS13_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||
"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","valid for 7200 seconds only (<daily)","",""
|
||||
"SSL_sessionID_support","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","supported","",""
|
||||
"sessionresumption_ID","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not supported","",""
|
||||
"TLS_timestamp","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","random","",""
|
||||
"certificate_compression","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","none","",""
|
||||
"clientAuth","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","none","",""
|
||||
"cert_numbers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","",""
|
||||
"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","",""
|
||||
"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","--","",""
|
||||
"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","",""
|
||||
"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","404 Not Found ('/')","",""
|
||||
"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1793779861","",""
|
||||
"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","",""
|
||||
"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No Server banner line in header, interesting!","",""
|
||||
"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","X-Powered-By: Express","",""
|
||||
"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*","",""
|
||||
"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","","CWE-200"
|
||||
"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","30","",""
|
||||
"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","27","",""
|
||||
"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","36","",""
|
||||
"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","93","",""
|
||||
"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","A+","",""
|
||||
|
@@ -0,0 +1,242 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
<u>TLSv1.3</u> (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||
<span style="font-weight:bold;"> Application banner </span><span style="color:#8a7237;font-weight:bold;">X-Powered-By</span>: Express'
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span> -- mitigated (disconnect after 4/10 attempts)
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,841 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793779827",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-infra1-eu.shelly.cloud",
|
||||
"ip" : "35.205.173.252",
|
||||
"port" : "9443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc027",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc028",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc061",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc060",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc051",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc050",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3d",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3c",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "OK",
|
||||
"finding" : "X25519MLKEM768"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "DH_groups",
|
||||
"severity" : "OK",
|
||||
"finding" : "ffdhe2048 ffdhe3072"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "valid for 7200 seconds only (<daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "404 Not Found ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793779861"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No Server banner line in header, interesting!"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "X-Powered-By: Express"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, mitigated"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 74
|
||||
}
|
||||
@@ -0,0 +1,221 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
[4mTLSv1.3[m (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[1;33mnot offered[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||
[1m Application banner [m[33m[1mX-Powered-By(B[m: Express
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m -- mitigated (disconnect after 4/10 attempts)
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,174 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","repo.shelly.cloud/35.241.201.25","443","INFO","HTTP","",""
|
||||
"pre_128cipher","repo.shelly.cloud/35.241.201.25","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","repo.shelly.cloud/35.241.201.25","443","OK","not offered","",""
|
||||
"SSLv3","repo.shelly.cloud/35.241.201.25","443","OK","not offered","",""
|
||||
"TLS1","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||
"TLS1_1","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||
"TLS1_2","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||
"TLS1_3","repo.shelly.cloud/35.241.201.25","443","OK","offered with final","",""
|
||||
"NPN","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||
"ALPN","repo.shelly.cloud/35.241.201.25","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||
"cipherlist_STRONG_FS","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_2_xc030","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9f","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xccaa","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc02f","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9e","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_2","repo.shelly.cloud/35.241.201.25","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||
"cipher_order-tls1_3","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","repo.shelly.cloud/35.241.201.25","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a server cipher order configured","",""
|
||||
"FS","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||
"FS_ciphers","repo.shelly.cloud/35.241.201.25","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||
"FS_KEMs","repo.shelly.cloud/35.241.201.25","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","repo.shelly.cloud/35.241.201.25","443","OK","prime256v1 secp384r1 X25519","",""
|
||||
"DH_groups","repo.shelly.cloud/35.241.201.25","443","OK","ffdhe2048","",""
|
||||
"FS_TLS12_sig_algs","repo.shelly.cloud/35.241.201.25","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224","",""
|
||||
"FS_TLS13_sig_algs","repo.shelly.cloud/35.241.201.25","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","repo.shelly.cloud/35.241.201.25","443","INFO","'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","repo.shelly.cloud/35.241.201.25","443","INFO","no -- no lifetime advertised","",""
|
||||
"SSL_sessionID_support","repo.shelly.cloud/35.241.201.25","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","repo.shelly.cloud/35.241.201.25","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","repo.shelly.cloud/35.241.201.25","443","INFO","supported","",""
|
||||
"TLS_timestamp","repo.shelly.cloud/35.241.201.25","443","INFO","random","",""
|
||||
"certificate_compression","repo.shelly.cloud/35.241.201.25","443","INFO","none","",""
|
||||
"clientAuth","repo.shelly.cloud/35.241.201.25","443","INFO","none","",""
|
||||
"cert_numbers","repo.shelly.cloud/35.241.201.25","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","repo.shelly.cloud/35.241.201.25","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","repo.shelly.cloud/35.241.201.25","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","repo.shelly.cloud/35.241.201.25","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","repo.shelly.cloud/35.241.201.25","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","repo.shelly.cloud/35.241.201.25","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","repo.shelly.cloud/35.241.201.25","443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","repo.shelly.cloud/35.241.201.25","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","repo.shelly.cloud/35.241.201.25","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","repo.shelly.cloud/35.241.201.25","443","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","repo.shelly.cloud/35.241.201.25","443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","repo.shelly.cloud/35.241.201.25","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","repo.shelly.cloud/35.241.201.25","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","repo.shelly.cloud/35.241.201.25","443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","repo.shelly.cloud/35.241.201.25","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","repo.shelly.cloud/35.241.201.25","443","INFO","no","",""
|
||||
"cert_expirationStatus","repo.shelly.cloud/35.241.201.25","443","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","repo.shelly.cloud/35.241.201.25","443","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","repo.shelly.cloud/35.241.201.25","443","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","repo.shelly.cloud/35.241.201.25","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","repo.shelly.cloud/35.241.201.25","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","repo.shelly.cloud/35.241.201.25","443","INFO","--","",""
|
||||
"cert_ocspURL","repo.shelly.cloud/35.241.201.25","443","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||
"cert_ocspRevoked","repo.shelly.cloud/35.241.201.25","443","OK","not revoked","",""
|
||||
"cert_mustStapleExtension","repo.shelly.cloud/35.241.201.25","443","INFO","--","",""
|
||||
"DNS_CAArecord","repo.shelly.cloud/35.241.201.25","443","LOW","--","",""
|
||||
"certificate_transparency","repo.shelly.cloud/35.241.201.25","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","repo.shelly.cloud/35.241.201.25","443","INFO","4","",""
|
||||
"certs_list_ordering_problem","repo.shelly.cloud/35.241.201.25","443","INFO","no","",""
|
||||
"cert_caIssuers","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","repo.shelly.cloud/35.241.201.25","443","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","repo.shelly.cloud/35.241.201.25","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","repo.shelly.cloud/35.241.201.25","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","repo.shelly.cloud/35.241.201.25","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","repo.shelly.cloud/35.241.201.25","443","INFO","401 Unauthorized ('/') --","",""
|
||||
"HTTP_clock_skew","repo.shelly.cloud/35.241.201.25","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","repo.shelly.cloud/35.241.201.25","443","INFO","1793780243","",""
|
||||
"HSTS","repo.shelly.cloud/35.241.201.25","443","LOW","not offered","",""
|
||||
"HPKP","repo.shelly.cloud/35.241.201.25","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","repo.shelly.cloud/35.241.201.25","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||
"banner_application","repo.shelly.cloud/35.241.201.25","443","INFO","No application banner found","",""
|
||||
"cookie_count","repo.shelly.cloud/35.241.201.25","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","repo.shelly.cloud/35.241.201.25","443","INFO","*","",""
|
||||
"banner_reverseproxy","repo.shelly.cloud/35.241.201.25","443","INFO","--","","CWE-200"
|
||||
"heartbleed","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","repo.shelly.cloud/35.241.201.25","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","repo.shelly.cloud/35.241.201.25","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","repo.shelly.cloud/35.241.201.25","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","repo.shelly.cloud/35.241.201.25","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM-common_primes","repo.shelly.cloud/35.241.201.25","443","INFO","RFC7919/ffdhe2048","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"BEAST","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||
"winshock","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_101_win10_21h2","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-thunderbird_91_9","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","repo.shelly.cloud/35.241.201.25","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","repo.shelly.cloud/35.241.201.25","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","repo.shelly.cloud/35.241.201.25","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","30","",""
|
||||
"key_exchange_score","repo.shelly.cloud/35.241.201.25","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","27","",""
|
||||
"cipher_strength_score","repo.shelly.cloud/35.241.201.25","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","36","",""
|
||||
"final_score","repo.shelly.cloud/35.241.201.25","443","INFO","93","",""
|
||||
"overall_grade","repo.shelly.cloud/35.241.201.25","443","OK","A+","",""
|
||||
|
@@ -0,0 +1,229 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:16:54 -->> 35.241.201.25:443 (repo.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (35.241.201.25): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
x9f DHE-RSA-AES256-GCM-SHA384 DH<span style="color:#008817;"> 2048</span> AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xccaa DHE-RSA-CHACHA20-POLY1305 DH<span style="color:#008817;"> 2048</span> ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9e DHE-RSA-AES128-GCM-SHA256 DH<span style="color:#008817;"> 2048</span> AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||
(limited sense as client will pick)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||
DHE-RSA-AES128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> DH group offered: </span><span style="color:#008817;">ffdhe2048</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "status request/#5"
|
||||
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "supported versions/#43"
|
||||
"key share/#51" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#008817;">offered</span>, <span style="color:#008817;">not revoked</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 401 Unauthorized
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental common prime with 2048 bits detected: <i>RFC7919/ffdhe2048</i> (<span style="color:#008817;">2048 bits</span>),
|
||||
but no DH EXPORT ciphers
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||
IE 11 Win Phone 8.1 No connection
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:17:46 [ 53s] -->> 35.241.201.25:443 (repo.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,785 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_repo repo.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793780213",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "repo.shelly.cloud",
|
||||
"ip" : "35.241.201.25",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xccaa",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9e",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a server cipher order configured"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 X25519"
|
||||
},{
|
||||
"id" : "DH_groups",
|
||||
"severity" : "OK",
|
||||
"finding" : "ffdhe2048"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no -- no lifetime advertised"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cert_ocspRevoked",
|
||||
"severity" : "OK",
|
||||
"finding" : "not revoked"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "401 Unauthorized ('/') --"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793780243"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "no session ticket extension"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "RFC7919/ffdhe2048"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 53
|
||||
}
|
||||
@@ -0,0 +1,208 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_repo repo.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:16:54 -->> 35.241.201.25:443 (repo.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (35.241.201.25): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
x9f DHE-RSA-AES256-GCM-SHA384 DH[0;32m 2048[m AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xccaa DHE-RSA-CHACHA20-POLY1305 DH[0;32m 2048[m ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9e DHE-RSA-AES128-GCM-SHA256 DH[0;32m 2048[m AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [mno
|
||||
(limited sense as client will pick)
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||
DHE-RSA-AES128-GCM-SHA256
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32mX25519[m
|
||||
[1m DH group offered: [m[0;32mffdhe2048[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "status request/#5"
|
||||
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "supported versions/#43"
|
||||
"key share/#51" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: yes
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[0;32moffered[m, [0;32mnot revoked[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 401 Unauthorized
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental common prime with 2048 bits detected: [3mRFC7919/ffdhe2048[m ([0;32m2048 bits[m),
|
||||
but no DH EXPORT ciphers
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||
IE 11 Win Phone 8.1 No connection
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 09:17:46 [ 53s] -->> 35.241.201.25:443 (repo.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
Reference in New Issue
Block a user