diff --git a/Document1-Network.md b/Document1-Network.md index d4342ab..c2dbc6f 100644 --- a/Document1-Network.md +++ b/Document1-Network.md @@ -3,7 +3,7 @@ | DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. | | DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code | Open | Test not yet performed. | | DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. | -| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | Open | Test not yet performed. | +| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | PASS (with findings) | Device: no outdated software on the bridge's exposed interface. Ecosystem (LOQED/Shelly cloud): TLS broadly strong, but low/medium hardening issues, client-initiated renegotiation on `shelly-120:6113` (DoS), TLS 1.3 absent on 2 hosts, outdated nginx 1.21.6 on integrations, version/OS & Express banners, shared `*.shelly.cloud wildcard cert`, missing HSTS, BREACH preconditions on 2 hosts. | | DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | PASS | No unnecesarrily open ports on the bridge | | DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. | | DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. | @@ -28,7 +28,57 @@ ### DES-08 -- **Verdict: Open** +The DES considered for this test are: +- `mqtt.production.loqed.com:8883` +- `integrations.loqed.com:443` + - No HSTS header + - Outdated nginx +- `api.production.loqed.com:443` + - No HSTS header +- All of the above: + - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers + + +And the shelly cloud services: +- `control.shelly.cloud:443` + - No HSTS header + - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers + - Potentially vuln. to CVE-2013-3587 + - Google’s/Shelly’s hosting config +- `shelly-120-eu.shelly.cloud:443` + - No HSTS header + - Exposes nginx and Ubuntu OS +- `:6113` + - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers + - **Vulnerable to secure client-initiated renegotiation** +- `shelly-101-eu.shelly.cloud:31234` + - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers + - No HSTS header +- `shelly-infra1-eu.shelly.cloud:443` + - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers + - No HSTS header + - Exposes nginx and Ubuntu OS + - **No TLS 1.3** +- `:9443` + - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers + - Exposes application banner x-powered-by express + - No HSTS header +- `changelog-backend.shelly.cloud:443` + - **No TLS 1.3** + - Exposes nginx and Ubuntu OS + - Potentially vuln. to CVE-2013-3587 + - Google’s/Shelly’s hosting config +- `repo.shelly.cloud:443` + - Exposes nginx and Ubuntu OS +- All `*.shelly.cloud` use wildcard cert. + +```bash +testssl -oA +``` + +- **Results**: [testssl reports](test_case_evidence/DES/DES08/) + +- **Verdict: PASS (with findings)** ### DES-09 @@ -46,7 +96,7 @@ In our network it currently has the address `10.12.2.30`. > After the factory reset I had to reconfigure the bridge to determine its new IP. > The procedure was captured [here](network/captures/init_after_reset.pcapng) and re-run through the PreTester [here](network/pretester_reports/init_after_reset_report.md). -- **Result**: [nmap report](network/nmap/des09_bridge.nmap) +- **Result**: [nmap report](test_case_evidence/DES/DES09/des09_bridge.nmap) Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext). All other ports are filtered. diff --git a/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.csv b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.csv new file mode 100644 index 0000000..edcd64d --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.csv @@ -0,0 +1,172 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","api.production.loqed.com/34.155.200.196","443","INFO","HTTP","","" +"pre_128cipher","api.production.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","","" +"SSLv2","api.production.loqed.com/34.155.200.196","443","OK","not offered","","" +"SSLv3","api.production.loqed.com/34.155.200.196","443","OK","not offered","","" +"TLS1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","" +"TLS1_1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","" +"TLS1_2","api.production.loqed.com/34.155.200.196","443","OK","offered","","" +"TLS1_3","api.production.loqed.com/34.155.200.196","443","OK","offered with final","","" +"NPN","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","" +"ALPN_HTTP2","api.production.loqed.com/34.155.200.196","443","OK","h2","","" +"ALPN","api.production.loqed.com/34.155.200.196","443","INFO","http/1.1","","" +"cipherlist_NULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_LOW","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","api.production.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","api.production.loqed.com/34.155.200.196","443","OK","offered","","" +"cipherlist_STRONG_FS","api.production.loqed.com/34.155.200.196","443","OK","offered","","" +"cipher_order-tls1_2","api.production.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","","" +"cipher-tls1_2_xc02f","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc030","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca8","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc013","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_xc014","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x9c","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_x9d","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_x2f","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x35","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipherorder_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","","" +"prioritize_chacha_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","true","","" +"cipher_order-tls1_3","api.production.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_3_x1302","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_3","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"cipher_order","api.production.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","","" +"FS","api.production.loqed.com/34.155.200.196","443","OK","offered","","" +"FS_ciphers","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","","" +"FS_KEMs","api.production.loqed.com/34.155.200.196","443","LOW","No KEMs offered","","" +"FS_ECDHE_curves","api.production.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","","" +"FS_TLS12_sig_algs","api.production.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","","" +"FS_TLS13_sig_algs","api.production.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","","" +"TLS_extensions","api.production.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","api.production.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","","" +"SSL_sessionID_support","api.production.loqed.com/34.155.200.196","443","INFO","yes","","" +"sessionresumption_ticket","api.production.loqed.com/34.155.200.196","443","INFO","not supported","","" +"sessionresumption_ID","api.production.loqed.com/34.155.200.196","443","INFO","supported","","" +"TLS_timestamp","api.production.loqed.com/34.155.200.196","443","INFO","random","","" +"certificate_compression","api.production.loqed.com/34.155.200.196","443","INFO","none","","" +"clientAuth","api.production.loqed.com/34.155.200.196","443","INFO","none","","" +"cert_numbers","api.production.loqed.com/34.155.200.196","443","INFO","1","","" +"cert_signatureAlgorithm","api.production.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","","" +"cert_keySize","api.production.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","","" +"cert_keyUsage","api.production.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","","" +"cert_extKeyUsage","api.production.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","","" +"cert_serialNumber","api.production.loqed.com/34.155.200.196","443","INFO","056B01F8C0078A7719EB49BF14357173112F","","" +"cert_serialNumberLen","api.production.loqed.com/34.155.200.196","443","INFO","18","","" +"cert_fingerprintSHA1","api.production.loqed.com/34.155.200.196","443","INFO","6A4E93FA165A64A590BF098743A6D7DD99911DEE","","" +"cert_fingerprintSHA256","api.production.loqed.com/34.155.200.196","443","INFO","11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","","" +"cert","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----","","" +"cert_commonName","api.production.loqed.com/34.155.200.196","443","OK","api.production.loqed.com","","" +"cert_commonName_wo_SNI","api.production.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","","" +"cert_subjectAltName","api.production.loqed.com/34.155.200.196","443","INFO","api.production.loqed.com","","" +"cert_trust","api.production.loqed.com/34.155.200.196","443","OK","Ok via SAN and CN (SNI mandatory)","","" +"cert_chain_of_trust","api.production.loqed.com/34.155.200.196","443","OK","passed.","","" +"cert_certificatePolicies_EV","api.production.loqed.com/34.155.200.196","443","INFO","no","","" +"cert_expirationStatus","api.production.loqed.com/34.155.200.196","443","OK","86 >= 30 days","","" +"cert_notBefore","api.production.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:16","","" +"cert_notAfter","api.production.loqed.com/34.155.200.196","443","OK","2027-01-30 01:16","","" +"cert_extlifeSpan","api.production.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","api.production.loqed.com/34.155.200.196","443","INFO","not present","","" +"cert_crlDistributionPoints","api.production.loqed.com/34.155.200.196","443","INFO","http://yr2.c.lencr.org/48.crl","","" +"cert_ocspURL","api.production.loqed.com/34.155.200.196","443","INFO","--","","" +"OCSP_stapling","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","" +"cert_mustStapleExtension","api.production.loqed.com/34.155.200.196","443","INFO","--","","" +"DNS_CAArecord","api.production.loqed.com/34.155.200.196","443","LOW","--","","" +"certificate_transparency","api.production.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","","" +"certs_countServer","api.production.loqed.com/34.155.200.196","443","INFO","3","","" +"certs_list_ordering_problem","api.production.loqed.com/34.155.200.196","443","INFO","no","","" +"cert_caIssuers","api.production.loqed.com/34.155.200.196","443","INFO","YR2 (Let's Encrypt from US)","","" +"intermediate_cert <#1>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","api.production.loqed.com/34.155.200.196","443","INFO","238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47","","" +"intermediate_cert_notBefore <#1>","api.production.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","","" +"intermediate_cert_notAfter <#1>","api.production.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","","" +"intermediate_cert_expiration <#1>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","api.production.loqed.com/34.155.200.196","443","INFO","YR2 <-- Root YR","","" +"intermediate_cert <#2>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","api.production.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","","" +"intermediate_cert_notBefore <#2>","api.production.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","","" +"intermediate_cert_notAfter <#2>","api.production.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","","" +"intermediate_cert_expiration <#2>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","api.production.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","","" +"intermediate_cert_badOCSP","api.production.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","api.production.loqed.com/34.155.200.196","443","WARN","Unexpected 415 Unsupported Media Type @ '/'","","" +"HTTP_clock_skew","api.production.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","api.production.loqed.com/34.155.200.196","443","INFO","1793777783","","" +"HSTS","api.production.loqed.com/34.155.200.196","443","LOW","not offered","","" +"HPKP","api.production.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","api.production.loqed.com/34.155.200.196","443","INFO","No Server banner line in header, interesting!","","" +"banner_application","api.production.loqed.com/34.155.200.196","443","INFO","No application banner found","","" +"cookie_count","api.production.loqed.com/34.155.200.196","443","INFO","1 at '/' (maybe missed the application)","","" +"cookie_secure","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as secure","","" +"cookie_httponly","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as HttpOnly (maybe missed the application)","","" +"security_headers","api.production.loqed.com/34.155.200.196","443","MEDIUM","--","","" +"banner_reverseproxy","api.production.loqed.com/34.155.200.196","443","INFO","--","","CWE-200" +"heartbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200" +"ROBOT","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","api.production.loqed.com/34.155.200.196","443","OK","supported","","CWE-310" +"secure_client_renego","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","api.production.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","api.production.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","api.production.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","api.production.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_X","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_11_12","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_13_14","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_15","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chrome_101_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chromium_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_100_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-ie_8_win7","api.production.loqed.com/34.155.200.196","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_winphone81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-edge_133_win11_23h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_ios_184","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_154_osx_1231","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_osx_154","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_7u25","api.production.loqed.com/34.155.200.196","443","INFO","No connection","","" +"clientsimulation-java_80442","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1102","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1703","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_2106","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-go_1178","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-libressl_336","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","","" +"clientsimulation-openssl_102e","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-openssl_315","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-openssl_350","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-apple_mail_16_0","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"rating_spec","api.production.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","api.production.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","api.production.loqed.com/34.155.200.196","443","INFO","100","","" +"protocol_support_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","30","","" +"key_exchange_score","api.production.loqed.com/34.155.200.196","443","INFO","90","","" +"key_exchange_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","27","","" +"cipher_strength_score","api.production.loqed.com/34.155.200.196","443","INFO","90","","" +"cipher_strength_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","36","","" +"final_score","api.production.loqed.com/34.155.200.196","443","INFO","93","","" +"overall_grade","api.production.loqed.com/34.155.200.196","443","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.html b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.html new file mode 100644 index 0000000..dd979ee --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.html @@ -0,0 +1,225 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 08:35:56        -->> 34.155.200.196:443 (api.production.loqed.com) <<--
+
+ rDNS (34.155.200.196):  --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 h2, http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+TLSv1.3 (no server order, thus listed by strength)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- only for < TLS 1.3
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
+                              ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+                              RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "EC point formats/#11" "application layer protocol negotiation/#16"
+                              "session ticket/#35" "supported versions/#43" "key share/#51"
+                              "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily !
+ SSL Session ID support       yes
+ Session Resumption           Tickets no, ID: yes
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication
+ Serial                       056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
+ Fingerprints                 SHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
+                              SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
+ Common Name (CN)             api.production.loqed.com  (CN in response to request w/o SNI: TRAEFIK DEFAULT CERT )
+ subjectAltName (SAN)         api.production.loqed.com 
+ Trust (hostname)             Ok via SAN and CN (SNI mandatory)
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   86 >= 30 days (2026-11-01 01:16 --> 2027-01-30 01:16)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  http://yr2.c.lencr.org/48.crl
+ OCSP URI                     --
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        3
+ Issuer                       YR2 (Let's Encrypt from US)
+ Intermediate cert validity   #1: ok > 40 days (2028-09-02 23:59). YR2 <-- Root YR
+                              #2: ok > 40 days (2032-09-02 23:59). Root YR <-- ISRG Root X1
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             415 Unsupported Media Type. Oh, didn't expect "415 Unsupported Media Type"
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                (no "Server" line in header, interesting!)
+ Application banner           --
+ Cookie(s)                    1 issued: 1/1 secure, 1/1 HttpOnly -- HTTP status 415 signals you maybe missed the web application
+ Security headers             --
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 08:37:02 [  67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.json b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.json new file mode 100644 index 0000000..9cc6165 --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.json @@ -0,0 +1,777 @@ +{ + "Invocation" : "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793777755", + "scanResult" : [ + { + "targetHost" : "api.production.loqed.com", + "ip" : "34.155.200.196", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN_HTTP2", + "severity" : "OK", + "finding" : "h2" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "true" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server -- TLS 1.3 client determined" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "LOW", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "LOW", + "finding" : "valid for 604800 seconds (>daily)" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "certificate_compression", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "SHA256 with RSA" + },{ + "id" : "cert_keySize", + "severity" : "INFO", + "finding" : "RSA 2048 bits (exponent is 65537)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature, Key Encipherment" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "056B01F8C0078A7719EB49BF14357173112F" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "18" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "6A4E93FA165A64A590BF098743A6D7DD99911DEE" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "api.production.loqed.com" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "TRAEFIK DEFAULT CERT" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "api.production.loqed.com" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN and CN (SNI mandatory)" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "86 >= 30 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2026-11-01 01:16" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-30 01:16" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "http://yr2.c.lencr.org/48.crl" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "OCSP_stapling", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "3" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "YR2 (Let's Encrypt from US)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2025-09-03 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2028-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "YR2 <-- Root YR" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2026-05-13 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2032-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Root YR <-- ISRG Root X1" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "WARN", + "finding" : "Unexpected 415 Unsupported Media Type @ '/'" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793777783" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "No Server banner line in header, interesting!" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "1 at '/' (maybe missed the application)" + },{ + "id" : "cookie_secure", + "severity" : "OK", + "finding" : "All (1) at '/' marked as secure" + },{ + "id" : "cookie_httponly", + "severity" : "OK", + "finding" : "All (1) at '/' marked as HttpOnly (maybe missed the application)" + },{ + "id" : "security_headers", + "severity" : "MEDIUM", + "finding" : "--" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not vulnerable" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 67 +} diff --git a/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.log b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.log new file mode 100644 index 0000000..039794d --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_api/des08_loqed_api.log @@ -0,0 +1,204 @@ +## Scan started as: "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<-- + + rDNS (34.155.200.196): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 h2, http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA +TLSv1.3 (no server order, thus listed by strength) + x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- only for < TLS 1.3 + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA + ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "EC point formats/#11" "application layer protocol negotiation/#16" + "session ticket/#35" "supported versions/#43" "key share/#51" + "renegotiation info/#65281" + Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily ! + SSL Session ID support yes + Session Resumption Tickets no, ID: yes + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication + Serial 056B01F8C0078A7719EB49BF14357173112F (OK: length 18) + Fingerprints SHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE + SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998 + Common Name (CN) api.production.loqed.com  (CN in response to request w/o SNI: TRAEFIK DEFAULT CERT ) + subjectAltName (SAN) api.production.loqed.com  + Trust (hostname) Ok via SAN and CN (SNI mandatory) + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 86 >= 30 days (2026-11-01 01:16 --> 2027-01-30 01:16) + ETS/"eTLS", visibility info not present + Certificate Revocation List http://yr2.c.lencr.org/48.crl + OCSP URI -- + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 3 + Issuer YR2 (Let's Encrypt from US) + Intermediate cert validity #1: ok > 40 days (2028-09-02 23:59). YR2 <-- Root YR + #2: ok > 40 days (2032-09-02 23:59). Root YR <-- ISRG Root X1 + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  415 Unsupported Media Type. Oh, didn't expect "415 Unsupported Media Type" + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner (no "Server" line in header, interesting!) + Application banner -- + Cookie(s) 1 issued: 1/1 secure, 1/1 HttpOnly -- HTTP status 415 signals you maybe missed the web application + Security headers -- + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<-- + + diff --git a/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.csv b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.csv new file mode 100644 index 0000000..c56566e --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.csv @@ -0,0 +1,172 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","integrations.loqed.com/34.155.200.196","443","INFO","HTTP","","" +"pre_128cipher","integrations.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","","" +"SSLv2","integrations.loqed.com/34.155.200.196","443","OK","not offered","","" +"SSLv3","integrations.loqed.com/34.155.200.196","443","OK","not offered","","" +"TLS1","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","" +"TLS1_1","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","" +"TLS1_2","integrations.loqed.com/34.155.200.196","443","OK","offered","","" +"TLS1_3","integrations.loqed.com/34.155.200.196","443","OK","offered with final","","" +"NPN","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","" +"ALPN_HTTP2","integrations.loqed.com/34.155.200.196","443","OK","h2","","" +"ALPN","integrations.loqed.com/34.155.200.196","443","INFO","http/1.1","","" +"cipherlist_NULL","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_LOW","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","integrations.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","integrations.loqed.com/34.155.200.196","443","OK","offered","","" +"cipherlist_STRONG_FS","integrations.loqed.com/34.155.200.196","443","OK","offered","","" +"cipher_order-tls1_2","integrations.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","","" +"cipher-tls1_2_xc02f","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc030","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca8","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc013","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_xc014","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x9c","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_x9d","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_x2f","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x35","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipherorder_TLSv1_2","integrations.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","","" +"prioritize_chacha_TLSv1_2","integrations.loqed.com/34.155.200.196","443","INFO","true","","" +"cipher_order-tls1_3","integrations.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_3_x1302","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_3","integrations.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"cipher_order","integrations.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","","" +"FS","integrations.loqed.com/34.155.200.196","443","OK","offered","","" +"FS_ciphers","integrations.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","","" +"FS_KEMs","integrations.loqed.com/34.155.200.196","443","LOW","No KEMs offered","","" +"FS_ECDHE_curves","integrations.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","","" +"FS_TLS12_sig_algs","integrations.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","","" +"FS_TLS13_sig_algs","integrations.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","","" +"TLS_extensions","integrations.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","integrations.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","","" +"SSL_sessionID_support","integrations.loqed.com/34.155.200.196","443","INFO","yes","","" +"sessionresumption_ticket","integrations.loqed.com/34.155.200.196","443","INFO","not supported","","" +"sessionresumption_ID","integrations.loqed.com/34.155.200.196","443","INFO","supported","","" +"TLS_timestamp","integrations.loqed.com/34.155.200.196","443","INFO","random","","" +"certificate_compression","integrations.loqed.com/34.155.200.196","443","INFO","none","","" +"clientAuth","integrations.loqed.com/34.155.200.196","443","INFO","none","","" +"cert_numbers","integrations.loqed.com/34.155.200.196","443","INFO","1","","" +"cert_signatureAlgorithm","integrations.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","","" +"cert_keySize","integrations.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","","" +"cert_keyUsage","integrations.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","","" +"cert_extKeyUsage","integrations.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","","" +"cert_serialNumber","integrations.loqed.com/34.155.200.196","443","INFO","05C73CE106F84ABAC4E6D524DA93450B2C1C","","" +"cert_serialNumberLen","integrations.loqed.com/34.155.200.196","443","INFO","18","","" +"cert_fingerprintSHA1","integrations.loqed.com/34.155.200.196","443","INFO","80EDD7ED1004483BFF5FAC76EEB5BD58638464FF","","" +"cert_fingerprintSHA256","integrations.loqed.com/34.155.200.196","443","INFO","F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962","","" +"cert","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFNTCCBB2gAwIBAgISBcc84Qb4SrrE5tUk2pNFCywcMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAsMSowKAYDVQQDEyFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPWD0p9X/7gALsv5hZ8dAORgWdrVJVMiDF8goE/bywu79SsUIgjHP3ydju2CM14hvVPPFbvBHNBtisztJKz22JoqMYA+06nnlGjrxwaffepVTOlbvcrgyEOUW6uOz2PvHSR7KdatSJtfzkIhbF40DR85dYFn8MupGWcF830IaxvdeRqx+zhFFhzoNht0LwGLfqHGsUQyMcV5TM1070sUax6pNZuDcHi9NAOB8o/H5K9+awQ9tKfoTk1oPNWEjRPngjUZFukwlNwpTVevpiKSpp9UEcDSQzyXLD6TUbv0Y/asaDfo2yB9ozPxB4RxTbf4bMKXtgz6yJtmu6hsNxL5H7AgMBAAGjggJIMIICRDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUNf4wq1Iwtu2hTtj593uN4a2+quAwHwYDVR0jBBgwFoAUHy81vkYUgs1Asa55LFV4+vfUaPswMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIxLmkubGVuY3Iub3JnLzBEBgNVHREEPTA7ghZpbnRlZ3JhdGlvbnMubG9xZWQuY29tgiFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMS5jLmxlbmNyLm9yZy8yOS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgAAGl0aHC2TdbZIVXj4L3Ghrm7vOX0pfIrjFXvK3uGgHgAAAaGU3eXqAAAEAwBHMEUCIQCKrChfG4RVUy8Kp/suqQk9z3zDWpfjaQHS0437j28xvQIgSRyUMHc52kEyt2hO/x2yT8iahsWSU7VKFKGSEIuFa7AAfwBZbmwzhpSyWXKiVsig6N2QSnboCD3ahzsBCDgoFDzuWQAAAaGU3eZsAAgAAAUAGXbecwQDAEgwRgIhAKVoN8aabyItWJCrOqKTNt0qEpBs6Ooj1irv3yArILyrAiEAn8DXmfxWE/FsZBioMOOFHIJ2o1lFosHWnnrwbJGBFmkwDQYJKoZIhvcNAQELBQADggEBAEZEghbiA63425KThlZ5LQyhwRX6D+LLSrIqPb++Grz3DFEiIbQ7uNnexeSwaYXVmD1tsx0zXbSi3fDxP+KveynVLxdZQ8C78DMdAC0fk21/ZOyfwZ6v+c6HMJnaRRNFfIrFBaIdJQNsAGYhghB6zRcGqq9ye+4GnmvjNWFWAdxKZP0AUuNzxH66etPrWgDUlSJDwAsnU2dENJTQB/juN2VdIFu+bnZRDp2C5eMPHPZIX7P2sxwf2wXFmVqXCB3nKJKZuT1JJWlwwowPG0ZBpelC1ExMEBbgmTHZsebT/ILMmqPE+UkSYqsDEWNTNNGg6Td+hzUSDlUeJRKwpBSSXvA=\n-----END CERTIFICATE-----","","" +"cert_commonName","integrations.loqed.com/34.155.200.196","443","OK","integrations.production.loqed.com","","" +"cert_commonName_wo_SNI","integrations.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","","" +"cert_subjectAltName","integrations.loqed.com/34.155.200.196","443","INFO","integrations.loqed.com integrations.production.loqed.com","","" +"cert_trust","integrations.loqed.com/34.155.200.196","443","OK","Ok via SAN (SNI mandatory)","","" +"cert_chain_of_trust","integrations.loqed.com/34.155.200.196","443","OK","passed.","","" +"cert_certificatePolicies_EV","integrations.loqed.com/34.155.200.196","443","INFO","no","","" +"cert_expirationStatus","integrations.loqed.com/34.155.200.196","443","OK","86 >= 30 days","","" +"cert_notBefore","integrations.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:10","","" +"cert_notAfter","integrations.loqed.com/34.155.200.196","443","OK","2027-01-30 01:10","","" +"cert_extlifeSpan","integrations.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","integrations.loqed.com/34.155.200.196","443","INFO","not present","","" +"cert_crlDistributionPoints","integrations.loqed.com/34.155.200.196","443","INFO","http://yr1.c.lencr.org/29.crl","","" +"cert_ocspURL","integrations.loqed.com/34.155.200.196","443","INFO","--","","" +"OCSP_stapling","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","" +"cert_mustStapleExtension","integrations.loqed.com/34.155.200.196","443","INFO","--","","" +"DNS_CAArecord","integrations.loqed.com/34.155.200.196","443","LOW","--","","" +"certificate_transparency","integrations.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","","" +"certs_countServer","integrations.loqed.com/34.155.200.196","443","INFO","3","","" +"certs_list_ordering_problem","integrations.loqed.com/34.155.200.196","443","INFO","no","","" +"cert_caIssuers","integrations.loqed.com/34.155.200.196","443","INFO","YR1 (Let's Encrypt from US)","","" +"intermediate_cert <#1>","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","integrations.loqed.com/34.155.200.196","443","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","","" +"intermediate_cert_notBefore <#1>","integrations.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","","" +"intermediate_cert_notAfter <#1>","integrations.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","","" +"intermediate_cert_expiration <#1>","integrations.loqed.com/34.155.200.196","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","integrations.loqed.com/34.155.200.196","443","INFO","YR1 <-- Root YR","","" +"intermediate_cert <#2>","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","integrations.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","","" +"intermediate_cert_notBefore <#2>","integrations.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","","" +"intermediate_cert_notAfter <#2>","integrations.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","","" +"intermediate_cert_expiration <#2>","integrations.loqed.com/34.155.200.196","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","integrations.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","","" +"intermediate_cert_badOCSP","integrations.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","integrations.loqed.com/34.155.200.196","443","INFO","302 Found ('/')","","" +"HTTP_clock_skew","integrations.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","integrations.loqed.com/34.155.200.196","443","INFO","1793777307","","" +"HSTS","integrations.loqed.com/34.155.200.196","443","LOW","not offered","","" +"HPKP","integrations.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","integrations.loqed.com/34.155.200.196","443","INFO","nginx/1.21.6","","" +"banner_application","integrations.loqed.com/34.155.200.196","443","INFO","X-Powered-By: PHP/8.2.35","","" +"cookie_count","integrations.loqed.com/34.155.200.196","443","INFO","2 at '/' (30x detected, better try target URL of 30x)","","" +"cookie_secure","integrations.loqed.com/34.155.200.196","443","INFO","1/2 at '/' marked as secure","","" +"cookie_httponly","integrations.loqed.com/34.155.200.196","443","OK","All (2) at '/' marked as HttpOnly (30x detected, better try target URL of 30x)","","" +"Cache-Control","integrations.loqed.com/34.155.200.196","443","INFO","no-cache, private","","" +"banner_reverseproxy","integrations.loqed.com/34.155.200.196","443","INFO","--","","CWE-200" +"heartbleed","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200" +"ROBOT","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","integrations.loqed.com/34.155.200.196","443","OK","supported","","CWE-310" +"secure_client_renego","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","integrations.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","integrations.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","integrations.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","integrations.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_X","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_11_12","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_13_14","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_15","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chrome_101_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chromium_137_win11","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_100_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_137_win11","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-ie_8_win7","integrations.loqed.com/34.155.200.196","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_winphone81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-edge_133_win11_23h2","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_ios_184","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_154_osx_1231","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_osx_154","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_7u25","integrations.loqed.com/34.155.200.196","443","INFO","No connection","","" +"clientsimulation-java_80442","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1102","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1703","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_2106","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-go_1178","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-libressl_336","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","","" +"clientsimulation-openssl_102e","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-openssl_315","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-openssl_350","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-apple_mail_16_0","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"rating_spec","integrations.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","integrations.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","integrations.loqed.com/34.155.200.196","443","INFO","100","","" +"protocol_support_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","30","","" +"key_exchange_score","integrations.loqed.com/34.155.200.196","443","INFO","90","","" +"key_exchange_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","27","","" +"cipher_strength_score","integrations.loqed.com/34.155.200.196","443","INFO","90","","" +"cipher_strength_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","36","","" +"final_score","integrations.loqed.com/34.155.200.196","443","INFO","93","","" +"overall_grade","integrations.loqed.com/34.155.200.196","443","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.html b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.html new file mode 100644 index 0000000..c4fe45d --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.html @@ -0,0 +1,225 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 08:28:00        -->> 34.155.200.196:443 (integrations.loqed.com) <<--
+
+ rDNS (34.155.200.196):  --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 h2, http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+TLSv1.3 (no server order, thus listed by strength)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- only for < TLS 1.3
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
+                              ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+                              RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "EC point formats/#11" "application layer protocol negotiation/#16"
+                              "session ticket/#35" "supported versions/#43" "key share/#51"
+                              "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily !
+ SSL Session ID support       yes
+ Session Resumption           Tickets no, ID: yes
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication
+ Serial                       05C73CE106F84ABAC4E6D524DA93450B2C1C (OK: length 18)
+ Fingerprints                 SHA1 80EDD7ED1004483BFF5FAC76EEB5BD58638464FF
+                              SHA256 F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
+ Common Name (CN)             integrations.production.loqed.com  (CN in response to request w/o SNI: TRAEFIK DEFAULT CERT )
+ subjectAltName (SAN)         integrations.loqed.com integrations.production.loqed.com 
+ Trust (hostname)             Ok via SAN (SNI mandatory)
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   86 >= 30 days (2026-11-01 01:10 --> 2027-01-30 01:10)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  http://yr1.c.lencr.org/29.crl
+ OCSP URI                     --
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        3
+ Issuer                       YR1 (Let's Encrypt from US)
+ Intermediate cert validity   #1: ok > 40 days (2028-09-02 23:59). YR1 <-- Root YR
+                              #2: ok > 40 days (2032-09-02 23:59). Root YR <-- ISRG Root X1
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             302 Found, redirecting to "dashboard"
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                nginx/1.21.6'
+ Application banner           X-Powered-By: PHP/8.2.35'
+ Cookie(s)                    2 issued: 1/2 secure, 2/2 HttpOnly -- maybe better try target URL of 30x
+ Security headers             Cache-Control: no-cache, private
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 08:29:06 [  68s] -->> 34.155.200.196:443 (integrations.loqed.com) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.json b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.json new file mode 100644 index 0000000..e42e870 --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.json @@ -0,0 +1,777 @@ +{ + "Invocation" : "testssl -oA testssl/des08_loqed_integrations integrations.loqed.com:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793777278", + "scanResult" : [ + { + "targetHost" : "integrations.loqed.com", + "ip" : "34.155.200.196", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN_HTTP2", + "severity" : "OK", + "finding" : "h2" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "true" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server -- TLS 1.3 client determined" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "LOW", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "LOW", + "finding" : "valid for 604800 seconds (>daily)" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "certificate_compression", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "SHA256 with RSA" + },{ + "id" : "cert_keySize", + "severity" : "INFO", + "finding" : "RSA 2048 bits (exponent is 65537)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature, Key Encipherment" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "05C73CE106F84ABAC4E6D524DA93450B2C1C" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "18" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "80EDD7ED1004483BFF5FAC76EEB5BD58638464FF" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIFNTCCBB2gAwIBAgISBcc84Qb4SrrE5tUk2pNFCywcMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAsMSowKAYDVQQDEyFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPWD0p9X/7gALsv5hZ8dAORgWdrVJVMiDF8goE/bywu79SsUIgjHP3ydju2CM14hvVPPFbvBHNBtisztJKz22JoqMYA+06nnlGjrxwaffepVTOlbvcrgyEOUW6uOz2PvHSR7KdatSJtfzkIhbF40DR85dYFn8MupGWcF830IaxvdeRqx+zhFFhzoNht0LwGLfqHGsUQyMcV5TM1070sUax6pNZuDcHi9NAOB8o/H5K9+awQ9tKfoTk1oPNWEjRPngjUZFukwlNwpTVevpiKSpp9UEcDSQzyXLD6TUbv0Y/asaDfo2yB9ozPxB4RxTbf4bMKXtgz6yJtmu6hsNxL5H7AgMBAAGjggJIMIICRDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUNf4wq1Iwtu2hTtj593uN4a2+quAwHwYDVR0jBBgwFoAUHy81vkYUgs1Asa55LFV4+vfUaPswMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIxLmkubGVuY3Iub3JnLzBEBgNVHREEPTA7ghZpbnRlZ3JhdGlvbnMubG9xZWQuY29tgiFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMS5jLmxlbmNyLm9yZy8yOS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgAAGl0aHC2TdbZIVXj4L3Ghrm7vOX0pfIrjFXvK3uGgHgAAAaGU3eXqAAAEAwBHMEUCIQCKrChfG4RVUy8Kp/suqQk9z3zDWpfjaQHS0437j28xvQIgSRyUMHc52kEyt2hO/x2yT8iahsWSU7VKFKGSEIuFa7AAfwBZbmwzhpSyWXKiVsig6N2QSnboCD3ahzsBCDgoFDzuWQAAAaGU3eZsAAgAAAUAGXbecwQDAEgwRgIhAKVoN8aabyItWJCrOqKTNt0qEpBs6Ooj1irv3yArILyrAiEAn8DXmfxWE/FsZBioMOOFHIJ2o1lFosHWnnrwbJGBFmkwDQYJKoZIhvcNAQELBQADggEBAEZEghbiA63425KThlZ5LQyhwRX6D+LLSrIqPb++Grz3DFEiIbQ7uNnexeSwaYXVmD1tsx0zXbSi3fDxP+KveynVLxdZQ8C78DMdAC0fk21/ZOyfwZ6v+c6HMJnaRRNFfIrFBaIdJQNsAGYhghB6zRcGqq9ye+4GnmvjNWFWAdxKZP0AUuNzxH66etPrWgDUlSJDwAsnU2dENJTQB/juN2VdIFu+bnZRDp2C5eMPHPZIX7P2sxwf2wXFmVqXCB3nKJKZuT1JJWlwwowPG0ZBpelC1ExMEBbgmTHZsebT/ILMmqPE+UkSYqsDEWNTNNGg6Td+hzUSDlUeJRKwpBSSXvA=\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "integrations.production.loqed.com" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "TRAEFIK DEFAULT CERT" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "integrations.loqed.com integrations.production.loqed.com" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN (SNI mandatory)" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "86 >= 30 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2026-11-01 01:10" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-30 01:10" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "http://yr1.c.lencr.org/29.crl" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "OCSP_stapling", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "3" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "YR1 (Let's Encrypt from US)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2025-09-03 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2028-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "YR1 <-- Root YR" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2026-05-13 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2032-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Root YR <-- ISRG Root X1" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "302 Found ('/')" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793777307" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "nginx/1.21.6" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "X-Powered-By: PHP/8.2.35" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "2 at '/' (30x detected, better try target URL of 30x)" + },{ + "id" : "cookie_secure", + "severity" : "INFO", + "finding" : "1/2 at '/' marked as secure" + },{ + "id" : "cookie_httponly", + "severity" : "OK", + "finding" : "All (2) at '/' marked as HttpOnly (30x detected, better try target URL of 30x)" + },{ + "id" : "Cache-Control", + "severity" : "INFO", + "finding" : "no-cache, private" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not vulnerable" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 68 +} diff --git a/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.log b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.log new file mode 100644 index 0000000..a68341d --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_integrations/des08_loqed_integrations.log @@ -0,0 +1,204 @@ +## Scan started as: "testssl -oA testssl/des08_loqed_integrations integrations.loqed.com:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 08:28:00 -->> 34.155.200.196:443 (integrations.loqed.com) <<-- + + rDNS (34.155.200.196): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 h2, http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA +TLSv1.3 (no server order, thus listed by strength) + x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- only for < TLS 1.3 + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA + ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "EC point formats/#11" "application layer protocol negotiation/#16" + "session ticket/#35" "supported versions/#43" "key share/#51" + "renegotiation info/#65281" + Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily ! + SSL Session ID support yes + Session Resumption Tickets no, ID: yes + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication + Serial 05C73CE106F84ABAC4E6D524DA93450B2C1C (OK: length 18) + Fingerprints SHA1 80EDD7ED1004483BFF5FAC76EEB5BD58638464FF + SHA256 F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962 + Common Name (CN) integrations.production.loqed.com  (CN in response to request w/o SNI: TRAEFIK DEFAULT CERT ) + subjectAltName (SAN) integrations.loqed.com integrations.production.loqed.com  + Trust (hostname) Ok via SAN (SNI mandatory) + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 86 >= 30 days (2026-11-01 01:10 --> 2027-01-30 01:10) + ETS/"eTLS", visibility info not present + Certificate Revocation List http://yr1.c.lencr.org/29.crl + OCSP URI -- + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 3 + Issuer YR1 (Let's Encrypt from US) + Intermediate cert validity #1: ok > 40 days (2028-09-02 23:59). YR1 <-- Root YR + #2: ok > 40 days (2032-09-02 23:59). Root YR <-- ISRG Root X1 + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  302 Found, redirecting to "dashboard" + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner nginx/1(B.2(B1(B.6(B + Application banner X-Powered-By(B: PHP/8(B.2(B.3(B5(B + Cookie(s) 2 issued: 1/2 secure, 2/2 HttpOnly -- maybe better try target URL of 30x + Security headers Cache-Control: no-cache, private + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 08:29:06 [ 68s] -->> 34.155.200.196:443 (integrations.loqed.com) <<-- + + diff --git a/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.csv b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.csv new file mode 100644 index 0000000..22e95bf --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.csv @@ -0,0 +1,159 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","mqtt.production.loqed.com/34.155.200.196","8883","DEBUG","Couldn't determine service, skipping all HTTP checks","","" +"pre_128cipher","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No 128 cipher limit bug","","" +"SSLv2","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","" +"SSLv3","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","" +"TLS1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","" +"TLS1_1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","" +"TLS1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","","" +"TLS1_3","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered with final","","" +"NPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","" +"ALPN_HTTP2","mqtt.production.loqed.com/34.155.200.196","8883","OK","h2","","" +"ALPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http/1.1","","" +"cipherlist_NULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327" +"cipherlist_aNULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327" +"cipherlist_EXPORT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327" +"cipherlist_LOW","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","mqtt.production.loqed.com/34.155.200.196","8883","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","","" +"cipherlist_STRONG_FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","","" +"cipher_order-tls1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","","" +"cipher-tls1_2_xc02f","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc030","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca8","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc013","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_xc014","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x9c","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_x9d","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_x2f","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x35","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipherorder_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","","" +"prioritize_chacha_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","true","","" +"cipher_order-tls1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","NOT a cipher order configured","","" +"cipher-tls1_3_x1302","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"cipher_order","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- TLS 1.3 client determined","","" +"FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","","" +"FS_ciphers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","","" +"FS_KEMs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","No KEMs offered","","" +"FS_ECDHE_curves","mqtt.production.loqed.com/34.155.200.196","8883","OK","prime256v1 secp384r1 secp521r1 X25519","","" +"FS_TLS12_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","","" +"FS_TLS13_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","","" +"TLS_extensions","mqtt.production.loqed.com/34.155.200.196","8883","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","mqtt.production.loqed.com/34.155.200.196","8883","LOW","valid for 604800 seconds (>daily)","","" +"SSL_sessionID_support","mqtt.production.loqed.com/34.155.200.196","8883","INFO","yes","","" +"sessionresumption_ticket","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","","" +"sessionresumption_ID","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","","" +"TLS_timestamp","mqtt.production.loqed.com/34.155.200.196","8883","INFO","random","","" +"certificate_compression","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","","" +"clientAuth","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","","" +"cert_numbers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","1","","" +"cert_signatureAlgorithm","mqtt.production.loqed.com/34.155.200.196","8883","OK","SHA256 with RSA","","" +"cert_keySize","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA 2048 bits (exponent is 65537)","","" +"cert_keyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Digital Signature, Key Encipherment","","" +"cert_extKeyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS Web Server Authentication","","" +"cert_serialNumber","mqtt.production.loqed.com/34.155.200.196","8883","INFO","06E81D5B9CC230FE76507D0EA12EE2BF2BE6","","" +"cert_serialNumberLen","mqtt.production.loqed.com/34.155.200.196","8883","INFO","18","","" +"cert_fingerprintSHA1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","A5D4BB82B189F9E7924595FFCF31411019B6087F","","" +"cert_fingerprintSHA256","mqtt.production.loqed.com/34.155.200.196","8883","INFO","AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","","" +"cert","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----","","" +"cert_commonName","mqtt.production.loqed.com/34.155.200.196","8883","OK","mqtt.production.loqed.com","","" +"cert_commonName_wo_SNI","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TRAEFIK DEFAULT CERT","","" +"cert_subjectAltName","mqtt.production.loqed.com/34.155.200.196","8883","INFO","mqtt.production.loqed.com","","" +"cert_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","Ok via SAN and CN (SNI mandatory)","","" +"cert_chain_of_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","passed.","","" +"cert_certificatePolicies_EV","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","","" +"cert_expirationStatus","mqtt.production.loqed.com/34.155.200.196","8883","OK","86 >= 30 days","","" +"cert_notBefore","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-11-01 01:10","","" +"cert_notAfter","mqtt.production.loqed.com/34.155.200.196","8883","OK","2027-01-30 01:10","","" +"cert_extlifeSpan","mqtt.production.loqed.com/34.155.200.196","8883","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not present","","" +"cert_crlDistributionPoints","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http://yr1.c.lencr.org/103.crl","","" +"cert_ocspURL","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","","" +"OCSP_stapling","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","" +"cert_mustStapleExtension","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","","" +"DNS_CAArecord","mqtt.production.loqed.com/34.155.200.196","8883","LOW","--","","" +"certificate_transparency","mqtt.production.loqed.com/34.155.200.196","8883","OK","yes (certificate extension)","","" +"certs_countServer","mqtt.production.loqed.com/34.155.200.196","8883","INFO","3","","" +"certs_list_ordering_problem","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","","" +"cert_caIssuers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 (Let's Encrypt from US)","","" +"intermediate_cert <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","","" +"intermediate_cert_notBefore <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2025-09-03 00:00","","" +"intermediate_cert_notAfter <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2028-09-02 23:59","","" +"intermediate_cert_expiration <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 <-- Root YR","","" +"intermediate_cert <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","","" +"intermediate_cert_notBefore <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-05-13 00:00","","" +"intermediate_cert_notAfter <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2032-09-02 23:59","","" +"intermediate_cert_expiration <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Root YR <-- ISRG Root X1","","" +"intermediate_cert_badOCSP","mqtt.production.loqed.com/34.155.200.196","8883","OK","intermediate certificate(s) is/are ok","","" +"heartbleed","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200" +"ROBOT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","supported","","CWE-310" +"secure_client_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310" +"POODLE_SSL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","mqtt.production.loqed.com/34.155.200.196","8883","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","mqtt.production.loqed.com/34.155.200.196","8883","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","mqtt.production.loqed.com/34.155.200.196","8883","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_X","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_11_12","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_13_14","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_15","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chrome_101_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chromium_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_100_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-ie_8_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","","" +"clientsimulation-ie_11_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_winphone81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-edge_133_win11_23h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_ios_184","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_154_osx_1231","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_osx_154","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_7u25","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","","" +"clientsimulation-java_80442","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1102","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1703","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_2106","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-go_1178","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-libressl_336","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","","" +"clientsimulation-openssl_102e","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-openssl_315","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-openssl_350","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-apple_mail_16_0","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"rating_spec","mqtt.production.loqed.com/34.155.200.196","8883","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","mqtt.production.loqed.com/34.155.200.196","8883","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","100","","" +"protocol_support_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","30","","" +"key_exchange_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","","" +"key_exchange_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","27","","" +"cipher_strength_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","","" +"cipher_strength_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","36","","" +"final_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","93","","" +"overall_grade","mqtt.production.loqed.com/34.155.200.196","8883","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.html b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.html new file mode 100644 index 0000000..181d84a --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.html @@ -0,0 +1,212 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 08:16:45        -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--
+
+ rDNS (34.155.200.196):  --
+ Service detected:       Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 h2, http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+TLSv1.3 (no server order, thus listed by strength)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- only for < TLS 1.3
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
+                              ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+                              RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "EC point formats/#11" "application layer protocol negotiation/#16"
+                              "session ticket/#35" "supported versions/#43" "key share/#51"
+                              "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily !
+ SSL Session ID support       yes
+ Session Resumption           Tickets no, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication
+ Serial                       06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
+ Fingerprints                 SHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
+                              SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
+ Common Name (CN)             mqtt.production.loqed.com  (CN in response to request w/o SNI: TRAEFIK DEFAULT CERT )
+ subjectAltName (SAN)         mqtt.production.loqed.com 
+ Trust (hostname)             Ok via SAN and CN (SNI mandatory)
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   86 >= 30 days (2026-11-01 01:10 --> 2027-01-30 01:10)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  http://yr1.c.lencr.org/103.crl
+ OCSP URI                     --
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        3
+ Issuer                       YR1 (Let's Encrypt from US)
+ Intermediate cert validity   #1: ok > 40 days (2028-09-02 23:59). YR1 <-- Root YR
+                              #2: ok > 40 days (2032-09-02 23:59). Root YR <-- ISRG Root X1
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  (applicable only for HTTP service)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK) (not using HTTP anyway)
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+Could not determine the protocol, only simulating generic clients.
+
+ Running client simulations via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 08:17:48 [  64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.json b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.json new file mode 100644 index 0000000..b639b90 --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.json @@ -0,0 +1,722 @@ +{ + "Invocation" : "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793776604", + "scanResult" : [ + { + "targetHost" : "mqtt.production.loqed.com", + "ip" : "34.155.200.196", + "port" : "8883", + "rDNS" : "--", + "service" : "Couldn't determine service, skipping all HTTP checks", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN_HTTP2", + "severity" : "OK", + "finding" : "h2" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "true" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server -- TLS 1.3 client determined" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "LOW", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "LOW", + "finding" : "valid for 604800 seconds (>daily)" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "certificate_compression", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "SHA256 with RSA" + },{ + "id" : "cert_keySize", + "severity" : "INFO", + "finding" : "RSA 2048 bits (exponent is 65537)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature, Key Encipherment" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "06E81D5B9CC230FE76507D0EA12EE2BF2BE6" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "18" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "A5D4BB82B189F9E7924595FFCF31411019B6087F" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "mqtt.production.loqed.com" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "TRAEFIK DEFAULT CERT" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "mqtt.production.loqed.com" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN and CN (SNI mandatory)" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "86 >= 30 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2026-11-01 01:10" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-30 01:10" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "http://yr1.c.lencr.org/103.crl" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "OCSP_stapling", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "3" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "YR1 (Let's Encrypt from US)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2025-09-03 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2028-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "YR1 <-- Root YR" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2026-05-13 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2032-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Root YR <-- ISRG Root X1" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "INFO", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not applicable, not HTTP" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable (not using HTTP anyway)" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 64 +} diff --git a/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.log b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.log new file mode 100644 index 0000000..ddf41b9 --- /dev/null +++ b/test_case_evidence/DES/DES08/loqed_mqtt/des08_loqed_mqtt.log @@ -0,0 +1,191 @@ +## Scan started as: "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<-- + + rDNS (34.155.200.196): -- + Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 h2, http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA +TLSv1.3 (no server order, thus listed by strength) + x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- only for < TLS 1.3 + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA + ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "EC point formats/#11" "application layer protocol negotiation/#16" + "session ticket/#35" "supported versions/#43" "key share/#51" + "renegotiation info/#65281" + Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily ! + SSL Session ID support yes + Session Resumption Tickets no, ID: no + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication + Serial 06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18) + Fingerprints SHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F + SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A + Common Name (CN) mqtt.production.loqed.com  (CN in response to request w/o SNI: TRAEFIK DEFAULT CERT ) + subjectAltName (SAN) mqtt.production.loqed.com  + Trust (hostname) Ok via SAN and CN (SNI mandatory) + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 86 >= 30 days (2026-11-01 01:10 --> 2027-01-30 01:10) + ETS/"eTLS", visibility info not present + Certificate Revocation List http://yr1.c.lencr.org/103.crl + OCSP URI -- + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 3 + Issuer YR1 (Let's Encrypt from US) + Intermediate cert validity #1: ok > 40 days (2028-09-02 23:59). YR1 <-- Root YR + #2: ok > 40 days (2032-09-02 23:59). Root YR <-- ISRG Root X1 + Intermediate Bad OCSP (exp.) Ok + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. (applicable only for HTTP service) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) (not using HTTP anyway) + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + +Could not determine the protocol, only simulating generic clients. + + Running client simulations via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.csv b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.csv new file mode 100644 index 0000000..bad1645 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.csv @@ -0,0 +1,174 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","HTTP","","" +"pre_128cipher","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No 128 cipher limit bug","","" +"SSLv2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","" +"SSLv3","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","" +"TLS1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","" +"TLS1_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","" +"TLS1_2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","","" +"TLS1_3","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered + downgraded to weaker protocol","","" +"NPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","" +"ALPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http/1.1","","" +"cipherlist_NULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327" +"cipherlist_LOW","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310" +"cipherlist_STRONG_NOFS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","" +"cipherlist_STRONG_FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","","" +"cipher_order-tls1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_2_xc02c","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca9","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc02b","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"cipher_order","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a server cipher order configured","","" +"FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","","" +"FS_ciphers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"FS_KEMs","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","No KEMs offered","","" +"FS_ECDHE_curves","changelog-backend.shelly.cloud/34.62.47.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","","" +"FS_TLS12_sig_algs","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224","","" +"TLS_extensions","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'","","" +"TLS_session_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no -- no lifetime advertised","","" +"SSL_sessionID_support","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","yes","","" +"sessionresumption_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","","" +"sessionresumption_ID","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","","" +"TLS_timestamp","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","random","","" +"cert_compression","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","N/A","","" +"clientAuth","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","none","","" +"cert_numbers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1","","" +"cert_signatureAlgorithm","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ECDSA with SHA384","","" +"cert_keySize","changelog-backend.shelly.cloud/34.62.47.252","443","OK","EC 256 bits (curve P-256)","","" +"cert_keyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Digital Signature","","" +"cert_extKeyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS Web Server Authentication","","" +"cert_serialNumber","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0582918DB89B4A8A742D84FD104CDC41D76B","","" +"cert_serialNumberLen","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","18","","" +"cert_fingerprintSHA1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2B1B2A1E33BDD140FA382D85F749503A2CEB16FD","","" +"cert_fingerprintSHA256","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF","","" +"cert","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----","","" +"cert_commonName","changelog-backend.shelly.cloud/34.62.47.252","443","OK","changelog-backend.shelly.cloud","","" +"cert_commonName_wo_SNI","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*.shelly.cloud","","" +"cert_subjectAltName","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","changelog-backend.shelly.cloud","","" +"cert_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","Ok via SAN and CN (works w/o SNI)","","" +"cert_trust_wildcard","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","trust is via wildcard","","" +"cert_chain_of_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","passed.","","" +"cert_certificatePolicies_EV","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","","" +"cert_expirationStatus","changelog-backend.shelly.cloud/34.62.47.252","443","OK","46 >= 30 days","","" +"cert_notBefore","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-09-21 09:03","","" +"cert_notAfter","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2026-12-20 09:03","","" +"cert_extlifeSpan","changelog-backend.shelly.cloud/34.62.47.252","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not present","","" +"cert_crlDistributionPoints","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http://ye1.c.lencr.org/108.crl","","" +"cert_ocspURL","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","","" +"OCSP_stapling","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","" +"cert_mustStapleExtension","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","","" +"DNS_CAArecord","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","--","","" +"certificate_transparency","changelog-backend.shelly.cloud/34.62.47.252","443","OK","yes (certificate extension)","","" +"certs_countServer","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","4","","" +"certs_list_ordering_problem","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","","" +"cert_caIssuers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 (Let's Encrypt from US)","","" +"intermediate_cert <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07","","" +"intermediate_cert_notBefore <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2025-09-03 00:00","","" +"intermediate_cert_notAfter <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2028-09-02 23:59","","" +"intermediate_cert_expiration <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 <-- Root YE","","" +"intermediate_cert <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0","","" +"intermediate_cert_notBefore <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","","" +"intermediate_cert_notAfter <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","","" +"intermediate_cert_expiration <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Root YE <-- ISRG Root X2","","" +"intermediate_cert <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6","","" +"intermediate_cert_notBefore <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","","" +"intermediate_cert_notAfter <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","","" +"intermediate_cert_expiration <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ISRG Root X2 <-- ISRG Root X1","","" +"intermediate_cert_badOCSP","changelog-backend.shelly.cloud/34.62.47.252","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","404 Not Found ('/')","","" +"HTTP_clock_skew","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1793780149","","" +"HSTS_time","changelog-backend.shelly.cloud/34.62.47.252","443","OK","180 days (=15552000 seconds) > 15552000 seconds","","" +"HSTS_subdomains","changelog-backend.shelly.cloud/34.62.47.252","443","OK","includes subdomains","","" +"HSTS_preload","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","domain is NOT marked for preloading","","" +"HPKP","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","nginx/1.24.0 (Ubuntu)","","" +"banner_application","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No application banner found","","" +"cookie_count","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 at '/' (maybe missed the application)","","" +"X-Frame-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","SAMEORIGIN","","" +"X-Content-Type-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","nosniff","","" +"Content-Security-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","OK","default-src 'none'","","" +"Cross-Origin-Opener-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","","" +"Cross-Origin-Resource-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","","" +"Cross-Origin-Embedder-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","require-corp","","" +"X-XSS-Protection","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0","","" +"Access-Control-Allow-Origin","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*","","" +"Referrer-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no-referrer","","" +"banner_reverseproxy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","","CWE-200" +"heartbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no session ticket extension","CVE-2016-9244","CWE-200" +"ROBOT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","supported","","CWE-310" +"secure_client_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","changelog-backend.shelly.cloud/34.62.47.252","443","MEDIUM","potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no RSA certificate, can't be used with SSLv2 elsewhere","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-0169","CWE-310" +"winshock","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-android_X","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-android_11_12","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-android_13_14","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-android_15","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-chrome_101_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-chromium_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-firefox_100_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-firefox_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-ie_8_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_11_win81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_11_winphone81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-ie_11_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_15_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_101_win10_21h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_133_win11_23h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-safari_184_ios_184","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-safari_154_osx_1231","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-safari_184_osx_154","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-java_7u25","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","","" +"clientsimulation-java_80442","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-java_1102","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-java_1703","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-java_2106","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-go_1178","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"clientsimulation-libressl_336","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305","","" +"clientsimulation-openssl_102e","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_111d","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_315","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_350","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-apple_mail_16_0","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","","" +"clientsimulation-thunderbird_91_9","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"rating_spec","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","","" +"protocol_support_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","","" +"key_exchange_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","","" +"key_exchange_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","","" +"cipher_strength_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","90","","" +"cipher_strength_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","36","","" +"final_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","96","","" +"overall_grade","changelog-backend.shelly.cloud/34.62.47.252","443","OK","A-","","" +"grade_cap_warning_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS 1.3 is not supported","","" diff --git a/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.html b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.html new file mode 100644 index 0000000..9c5a105 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.html @@ -0,0 +1,224 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 09:15:32        -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--
+
+ rDNS (34.62.47.252):    --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    not offered and downgraded to a weaker protocol
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            not offered
+ Strong encryption (AEAD ciphers) with no FS       not offered
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (no server order, thus listed by strength)
+ xc02c   ECDHE-ECDSA-AES256-GCM-SHA384     ECDH 253   AESGCM      256      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384            
+ xcca9   ECDHE-ECDSA-CHACHA20-POLY1305     ECDH 253   ChaCha20    256      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256      
+ xc02b   ECDHE-ECDSA-AES128-GCM-SHA256     ECDH 253   AESGCM      128      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256            
+TLSv1.3
+ - 
+
+ Has server cipher order?     no
+ -- inconclusive test, matching cipher in list missing, better see above
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
+                              ECDHE-ECDSA-AES128-GCM-SHA256 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 X448 
+ TLS 1.2 sig_algs offered:    ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "server name/#0" "max fragment length/#1" "EC point formats/#11"
+                              "application layer protocol negotiation/#16"
+                              "extended master secret/#23" "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint no -- no lifetime advertised
+ SSL Session ID support       yes
+ Session Resumption           Tickets no, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Client Authentication        none
+ Signature Algorithm          ECDSA with SHA384
+ Server key size              EC 256 bits (curve P-256)
+ Server key usage             Digital Signature
+ Server extended key usage    TLS Web Server Authentication
+ Serial                       0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
+ Fingerprints                 SHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
+                              SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
+ Common Name (CN)             changelog-backend.shelly.cloud  (CN in response to request w/o SNI: *.shelly.cloud )
+ subjectAltName (SAN)         changelog-backend.shelly.cloud 
+ Trust (hostname)             Ok via SAN and CN (works w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   46 >= 30 days (2026-09-21 09:03 --> 2026-12-20 09:03)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  http://ye1.c.lencr.org/108.crl
+ OCSP URI                     --
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       YE1 (Let's Encrypt from US)
+ Intermediate cert validity   #1: ok > 40 days (2028-09-02 23:59). YE1 <-- Root YE
+                              #2: ok > 40 days (2032-09-02 23:59). Root YE <-- ISRG Root X2
+                              #3: ok > 40 days (2032-09-02 23:59). ISRG Root X2 <-- ISRG Root X1
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    180 days=15552000 s, includeSubDomains
+ Public Key Pinning           --
+ Server banner                nginx/1.24.0 (Ubuntu)'
+ Application banner           --
+ Cookie(s)                    (none issued at "/") -- HTTP status 404 signals you maybe missed the web application
+ Security headers             X-Frame-Options: SAMEORIGIN
+                              X-Content-Type-Options: nosniff
+                              Content-Security-Policy: default-src 'none'
+                              Cross-Origin-Opener-Policy: same-origin
+                              Cross-Origin-Resource-Policy: same-origin
+                              Cross-Origin-Embedder-Policy: require-corp
+                              X-XSS-Protection: 0
+                              Access-Control-Allow-Origin: *
+                              Referrer-Policy: no-referrer
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK), no session ticket extension
+ ROBOT                                     Server does not support any cipher suites that use RSA key transport
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    potentially NOT ok, "gzip" HTTP compression detected. - only supplied "/" tested
+                                           Can be ignored for static pages or if no secrets in the page
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     not vulnerable (OK)
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK) - ARIA, CHACHA or CCM ciphers found
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.2   ECDHE-ECDSA-CHACHA20-POLY1305     253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.2   ECDHE-ECDSA-AES128-GCM-SHA256     253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  100 (30)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  96
+ Overall Grade                A-
+ Grade warning                TLS 1.3 is not supported
+
+ Done 2026-11-04 09:16:16 [  46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.json b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.json new file mode 100644 index 0000000..1be6934 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.json @@ -0,0 +1,785 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793780130", + "scanResult" : [ + { + "targetHost" : "changelog-backend.shelly.cloud", + "ip" : "34.62.47.252", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "INFO", + "finding" : "not offered + downgraded to weaker protocol" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_2_xc02c", + "severity" : "OK", + "finding" : "TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca9", + "severity" : "OK", + "finding" : "TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc02b", + "severity" : "OK", + "finding" : "TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "cipher_order", + "severity" : "INFO", + "finding" : "NOT a server cipher order configured" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519 X448" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "no -- no lifetime advertised" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "cert_compression", + "severity" : "INFO", + "finding" : "N/A" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "ECDSA with SHA384" + },{ + "id" : "cert_keySize", + "severity" : "OK", + "finding" : "EC 256 bits (curve P-256)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "0582918DB89B4A8A742D84FD104CDC41D76B" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "18" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "2B1B2A1E33BDD140FA382D85F749503A2CEB16FD" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "changelog-backend.shelly.cloud" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "*.shelly.cloud" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "changelog-backend.shelly.cloud" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN and CN (works w/o SNI)" + },{ + "id" : "cert_trust_wildcard", + "severity" : "LOW", + "finding" : "trust is via wildcard" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "46 >= 30 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2026-09-21 09:03" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2026-12-20 09:03" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "http://ye1.c.lencr.org/108.crl" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "OCSP_stapling", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "YE1 (Let's Encrypt from US)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2025-09-03 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2028-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "YE1 <-- Root YE" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2026-05-13 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2032-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Root YE <-- ISRG Root X2" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2026-05-13 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2032-09-02 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "ISRG Root X2 <-- ISRG Root X1" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "404 Not Found ('/')" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793780149" + },{ + "id" : "HSTS_time", + "severity" : "OK", + "finding" : "180 days (=15552000 seconds) > 15552000 seconds" + },{ + "id" : "HSTS_subdomains", + "severity" : "OK", + "finding" : "includes subdomains" + },{ + "id" : "HSTS_preload", + "severity" : "INFO", + "finding" : "domain is NOT marked for preloading" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "nginx/1.24.0 (Ubuntu)" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/' (maybe missed the application)" + },{ + "id" : "X-Frame-Options", + "severity" : "OK", + "finding" : "SAMEORIGIN" + },{ + "id" : "X-Content-Type-Options", + "severity" : "OK", + "finding" : "nosniff" + },{ + "id" : "Content-Security-Policy", + "severity" : "OK", + "finding" : "default-src 'none'" + },{ + "id" : "Cross-Origin-Opener-Policy", + "severity" : "INFO", + "finding" : "same-origin" + },{ + "id" : "Cross-Origin-Resource-Policy", + "severity" : "INFO", + "finding" : "same-origin" + },{ + "id" : "Cross-Origin-Embedder-Policy", + "severity" : "INFO", + "finding" : "require-corp" + },{ + "id" : "X-XSS-Protection", + "severity" : "INFO", + "finding" : "0" + },{ + "id" : "Access-Control-Allow-Origin", + "severity" : "INFO", + "finding" : "*" + },{ + "id" : "Referrer-Policy", + "severity" : "INFO", + "finding" : "no-referrer" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "no session ticket extension" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable, no RSA key transport cipher" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "MEDIUM", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "no RSA certificate, can't be used with SSLv2 elsewhere" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "OK", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "96" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A-" + },{ + "id" : "grade_cap_warning_1", + "severity" : "INFO", + "finding" : "TLS 1.3 is not supported" + } + ] + } + ], + "scanTime" : 46 +} diff --git a/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.log b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.log new file mode 100644 index 0000000..2304b10 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_changelog/des08_shelly_changelog.log @@ -0,0 +1,203 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<-- + + rDNS (34.62.47.252): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 not offered and downgraded to a weaker protocol + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) not offered + Strong encryption (AEAD ciphers) with no FS not offered + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (no server order, thus listed by strength) + xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +TLSv1.3 + - + + Has server cipher order? no + -- inconclusive test, matching cipher in list missing, better see above + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 + ECDHE-ECDSA-AES128-GCM-SHA256 + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 + TLS 1.2 sig_algs offered: ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "server name/#0" "max fragment length/#1" "EC point formats/#11" + "application layer protocol negotiation/#16" + "extended master secret/#23" "renegotiation info/#65281" + Session Ticket RFC 5077 hint no -- no lifetime advertised + SSL Session ID support yes + Session Resumption Tickets no, ID: no + TLS clock skew Random values, no fingerprinting possible + Client Authentication none + Signature Algorithm ECDSA with SHA384 + Server key size EC 256 bits (curve P-256) + Server key usage Digital Signature + Server extended key usage TLS Web Server Authentication + Serial 0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18) + Fingerprints SHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD + SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF + Common Name (CN) changelog-backend.shelly.cloud  (CN in response to request w/o SNI: *.shelly.cloud ) + subjectAltName (SAN) changelog-backend.shelly.cloud  + Trust (hostname) Ok via SAN and CN (works w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 46 >= 30 days (2026-09-21 09:03 --> 2026-12-20 09:03) + ETS/"eTLS", visibility info not present + Certificate Revocation List http://ye1.c.lencr.org/108.crl + OCSP URI -- + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer YE1 (Let's Encrypt from US) + Intermediate cert validity #1: ok > 40 days (2028-09-02 23:59). YE1 <-- Root YE + #2: ok > 40 days (2032-09-02 23:59). Root YE <-- ISRG Root X2 + #3: ok > 40 days (2032-09-02 23:59). ISRG Root X2 <-- ISRG Root X1 + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  404 Not Found (Hint: supply a path which doesn't give a "404 Not Found") + HTTP clock skew 0 sec from localtime + Strict Transport Security 180 days=15552000 s, includeSubDomains + Public Key Pinning -- + Server banner nginx/1(B.2(B4(B.0(B (Ubuntu(B) + Application banner -- + Cookie(s) (none issued at "/") -- HTTP status 404 signals you maybe missed the web application + Security headers X-Frame-Options: SAMEORIGIN + X-Content-Type-Options: nosniff + Content-Security-Policy: default-src 'none' + Cross-Origin-Opener-Policy: same-origin + Cross-Origin-Resource-Policy: same-origin + Cross-Origin-Embedder-Policy: require-corp + X-XSS-Protection: 0 + Access-Control-Allow-Origin: * + Referrer-Policy: no-referrer + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), no session ticket extension + ROBOT Server does not support any cipher suites that use RSA key transport + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) potentially NOT ok, "gzip" HTTP compression detected. - only supplied "/" tested + Can be ignored for static pages or if no secrets in the page + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + no RSA certificate, thus certificate can't be used with SSLv2 elsewhere + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) + Winshock (CVE-2014-6321), experimental not vulnerable (OK) - ARIA, CHACHA or CCM ciphers found + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 100 (30) + Cipher Strength  (weighted) 90 (36) + Final Score 96 + Overall Grade A- + Grade warning TLS 1.3 is not supported + + Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.csv b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.csv new file mode 100644 index 0000000..db36f7e --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.csv @@ -0,0 +1,188 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","HTTP","","" +"pre_128cipher","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No 128 cipher limit bug","","" +"SSLv2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","" +"SSLv3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","" +"TLS1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","","" +"TLS1_1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","","" +"TLS1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","","" +"TLS1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered with final","","" +"NPN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","","" +"ALPN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","http/1.1","","" +"cipherlist_NULL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327" +"cipherlist_aNULL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327" +"cipherlist_EXPORT","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327" +"cipherlist_LOW","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","","" +"cipherlist_STRONG_FS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","","" +"cipher_order-tls1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","","" +"cipher-tls1_2_xc02f","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc030","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc027","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_xc028","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","","" +"cipher-tls1_2_xcca8","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc061","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_xc060","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_xc014","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_xc013","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x9d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc09d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","","" +"cipher-tls1_2_xc051","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_x9c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc09c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","","" +"cipher-tls1_2_xc050","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_x3d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","","" +"cipher-tls1_2_x3c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_x35","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x2f","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipherorder_TLSv1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","","" +"prioritize_chacha_TLSv1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","false","","" +"cipher_order-tls1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","","" +"cipher-tls1_3_x1302","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"cipherorder_TLSv1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"prioritize_chacha_TLSv1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","false","","" +"cipher_order","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","","" +"FS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","","" +"FS_ciphers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","","" +"FS_KEMs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","X25519MLKEM768","","" +"FS_ECDHE_curves","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","prime256v1 secp384r1 secp521r1 X25519 X448","","" +"DH_groups","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ffdhe2048 ffdhe3072","","" +"FS_TLS12_sig_algs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","","" +"FS_TLS13_sig_algs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","","" +"TLS_extensions","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","valid for 7200 seconds only (= 60 days","","" +"cert_notBefore","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2025-12-07 00:00","","" +"cert_notAfter","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2027-01-06 23:59","","" +"cert_extlifeSpan","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not present","","" +"cert_crlDistributionPoints","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","","" +"cert_ocspURL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","http://ocsp.sectigo.com","","" +"OCSP_stapling","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","not offered","","" +"cert_mustStapleExtension","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","","" +"DNS_CAArecord","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","--","","" +"certificate_transparency","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","yes (certificate extension)","","" +"certs_countServer","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","4","","" +"certs_list_ordering_problem","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","no","","" +"cert_caIssuers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","","" +"intermediate_cert <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","","" +"intermediate_cert_notBefore <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2036-03-21 23:59","","" +"intermediate_cert_expiration <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","","" +"intermediate_cert <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","","" +"intermediate_cert_notBefore <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","","" +"intermediate_cert <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","","" +"intermediate_cert_notBefore <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2010-02-01 00:00","","" +"intermediate_cert_notAfter <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","","" +"intermediate_cert_badOCSP","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","404 Not Found ('/')","","" +"HTTP_clock_skew","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","0 seconds from localtime","","" +"HTTP_headerTime","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","1793779578","","" +"HSTS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","not offered","","" +"HPKP","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No Server banner line in header, interesting!","","" +"banner_application","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No application banner found","","" +"cookie_count","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","0 at '/' (maybe missed the application)","","" +"Access-Control-Allow-Origin","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*","","" +"banner_reverseproxy","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","","CWE-200" +"heartbleed","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2016-9244","CWE-200" +"ROBOT","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","supported","","CWE-310" +"secure_client_renego","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310" +"CRIME_TLS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_X","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_11_12","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_13_14","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_15","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-chrome_101_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-chromium_137_win11","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-firefox_100_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-firefox_137_win11","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-ie_8_win7","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No connection","","" +"clientsimulation-ie_11_win7","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_winphone81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-edge_133_win11_23h2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_184_ios_184","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_154_osx_1231","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_184_osx_154","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_7u25","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No connection","","" +"clientsimulation-java_80442","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1102","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1703","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_2106","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-go_1178","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-libressl_336","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_102e","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_315","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_350","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-apple_mail_16_0","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"rating_spec","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","100","","" +"protocol_support_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","30","","" +"key_exchange_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","90","","" +"key_exchange_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","27","","" +"cipher_strength_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","90","","" +"cipher_strength_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","36","","" +"final_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","93","","" +"overall_grade","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.html b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.html new file mode 100644 index 0000000..867148c --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.html @@ -0,0 +1,242 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 09:05:46        -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--
+
+ rDNS (34.79.5.199):     --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xc027   ECDHE-RSA-AES128-SHA256           ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256              
+ xc028   ECDHE-RSA-AES256-SHA384           ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc061   ECDHE-ARIA256-GCM-SHA384          ECDH 253   ARIAGCM     256      TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384             
+ xc060   ECDHE-ARIA128-GCM-SHA256          ECDH 253   ARIAGCM     128      TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256             
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ xc09d   AES256-CCM                        RSA        AESCCM      256      TLS_RSA_WITH_AES_256_CCM                           
+ xc051   ARIA256-GCM-SHA384                RSA        ARIAGCM     256      TLS_RSA_WITH_ARIA_256_GCM_SHA384                   
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ xc09c   AES128-CCM                        RSA        AESCCM      128      TLS_RSA_WITH_AES_128_CCM                           
+ xc050   ARIA128-GCM-SHA256                RSA        ARIAGCM     128      TLS_RSA_WITH_ARIA_128_GCM_SHA256                   
+ x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256                    
+ x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256                    
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+TLSv1.3 (server order)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH/MLKEM AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH/MLKEM ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH/MLKEM AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- TLS 1.3 and below
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
+                              ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
+                              ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
+                              ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256 
+ KEMs offered                 X25519MLKEM768 
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 X448 
+ Finite field group:          ffdhe2048 ffdhe3072
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+                              RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "max fragment length/#1" "EC point formats/#11"
+                              "application layer protocol negotiation/#16" "encrypt-then-mac/#22"
+                              "extended master secret/#23" "session ticket/#35"
+                              "supported versions/#43" "key share/#51" "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily
+ SSL Session ID support       yes
+ Session Resumption           Tickets: yes, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication, TLS Web Client Authentication
+ Serial                       393425BF88EBDD03492962D4E9723D5E (OK: length 16)
+ Fingerprints                 SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
+                              SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Common Name (CN)             *.shelly.cloud 
+ subjectAltName (SAN)         *.shelly.cloud shelly.cloud 
+ Trust (hostname)             Ok via SAN wildcard and CN wildcard (same w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  --
+ OCSP URI                     http://ocsp.sectigo.com
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)
+ Intermediate cert validity   #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46
+                              #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority
+                              #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                (no "Server" line in header, interesting!)
+ Application banner           --
+ Cookie(s)                    (none issued at "/") -- HTTP status 404 signals you maybe missed the web application
+ Security headers             Access-Control-Allow-Origin: *
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK) -- mitigated (disconnect after 4/10 attempts)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 09:06:59 [  75s] -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.json b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.json new file mode 100644 index 0000000..583c984 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.json @@ -0,0 +1,841 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_cloud_101eu shelly-101-eu.shelly.cloud:31234", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793779544", + "scanResult" : [ + { + "targetHost" : "shelly-101-eu.shelly.cloud", + "ip" : "34.79.5.199", + "port" : "31234", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc027", + "severity" : "LOW", + "finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xc028", + "severity" : "LOW", + "finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc061", + "severity" : "OK", + "finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc060", + "severity" : "OK", + "finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc09d", + "severity" : "OK", + "finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM" + },{ + "id" : "cipher-tls1_2_xc051", + "severity" : "OK", + "finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc09c", + "severity" : "OK", + "finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM" + },{ + "id" : "cipher-tls1_2_xc050", + "severity" : "OK", + "finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x3d", + "severity" : "LOW", + "finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x3c", + "severity" : "LOW", + "finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipherorder_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "prioritize_chacha_TLSv1_3", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "OK", + "finding" : "X25519MLKEM768" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519 X448" + },{ + "id" : "DH_groups", + "severity" : "OK", + "finding" : "ffdhe2048 ffdhe3072" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "valid for 7200 seconds only (= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2025-12-07 00:00" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-06 23:59" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "http://ocsp.sectigo.com" + },{ + "id" : "OCSP_stapling", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2036-03-21 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2010-02-01 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "404 Not Found ('/')" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793779578" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "No Server banner line in header, interesting!" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/' (maybe missed the application)" + },{ + "id" : "Access-Control-Allow-Origin", + "severity" : "INFO", + "finding" : "*" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not vulnerable" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable, mitigated" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 75 +} diff --git a/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.log b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.log new file mode 100644 index 0000000..03db1a8 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_101eu/des08_shelly_cloud_101eu.log @@ -0,0 +1,221 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_cloud_101eu shelly-101-eu.shelly.cloud:31234" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 09:05:46 -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<-- + + rDNS (34.79.5.199): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM + xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384 + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM + xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256 + x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256 + x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256 + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA +TLSv1.3 (server order) + x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- TLS 1.3 and below + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 + ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 + ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256 + KEMs offered X25519MLKEM768 + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 + Finite field group: ffdhe2048 ffdhe3072 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "max fragment length/#1" "EC point formats/#11" + "application layer protocol negotiation/#16" "encrypt-then-mac/#22" + "extended master secret/#23" "session ticket/#35" + "supported versions/#43" "key share/#51" "renegotiation info/#65281" + Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily + SSL Session ID support yes + Session Resumption Tickets: yes, ID: no + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication + Serial 393425BF88EBDD03492962D4E9723D5E (OK: length 16) + Fingerprints SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7 + SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Common Name (CN) *.shelly.cloud  + subjectAltName (SAN) *.shelly.cloud shelly.cloud  + Trust (hostname) Ok via SAN wildcard and CN wildcard (same w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59) + ETS/"eTLS", visibility info not present + Certificate Revocation List -- + OCSP URI http://ocsp.sectigo.com + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB) + Intermediate cert validity #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46 + #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority + #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  404 Not Found (Hint: supply a path which doesn't give a "404 Not Found") + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner (no "Server" line in header, interesting!) + Application banner -- + Cookie(s) (none issued at "/") -- HTTP status 404 signals you maybe missed the web application + Security headers Access-Control-Allow-Origin: * + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) -- mitigated (disconnect after 4/10 attempts) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 09:06:59 [ 75s] -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.csv b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.csv new file mode 100644 index 0000000..bfe4df6 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.csv @@ -0,0 +1,174 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","HTTP","","" +"pre_128cipher","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No 128 cipher limit bug","","" +"SSLv2","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","" +"SSLv3","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","" +"TLS1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","" +"TLS1_1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","" +"TLS1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","","" +"TLS1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered with final","","" +"NPN","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","" +"ALPN","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","http/1.1","","" +"cipherlist_NULL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327" +"cipherlist_LOW","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","CWE-310" +"cipherlist_STRONG_NOFS","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","" +"cipherlist_STRONG_FS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","","" +"cipher_order-tls1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_2_xc030","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_x9f","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca8","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xccaa","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc02f","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_x9e","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","","" +"cipher_order-tls1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_3_x1302","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"cipher_order","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a server cipher order configured","","" +"FS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","","" +"FS_ciphers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","","" +"FS_KEMs","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","No KEMs offered","","" +"FS_ECDHE_curves","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","prime256v1 secp384r1 X25519","","" +"DH_groups","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ffdhe2048","","" +"FS_TLS12_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224","","" +"FS_TLS13_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","","" +"TLS_extensions","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no -- no lifetime advertised","","" +"SSL_sessionID_support","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","yes","","" +"sessionresumption_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not supported","","" +"sessionresumption_ID","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","supported","","" +"TLS_timestamp","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","random","","" +"certificate_compression","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","none","","" +"clientAuth","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","none","","" +"cert_numbers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","1","","" +"cert_signatureAlgorithm","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","SHA256 with RSA","","" +"cert_keySize","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA 2048 bits (exponent is 65537)","","" +"cert_keyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Digital Signature, Key Encipherment","","" +"cert_extKeyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","","" +"cert_serialNumber","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","393425BF88EBDD03492962D4E9723D5E","","" +"cert_serialNumberLen","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","16","","" +"cert_fingerprintSHA1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","","" +"cert_fingerprintSHA256","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","","" +"cert","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","","" +"cert_commonName","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","*.shelly.cloud","","" +"cert_commonName_wo_SNI","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*.shelly.cloud","","" +"cert_subjectAltName","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*.shelly.cloud shelly.cloud","","" +"cert_trust","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","","" +"cert_trust_wildcard","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","trust is via wildcard","","" +"cert_chain_of_trust","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","passed.","","" +"cert_certificatePolicies_EV","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no","","" +"cert_expirationStatus","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","63 >= 60 days","","" +"cert_notBefore","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2025-12-07 00:00","","" +"cert_notAfter","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2027-01-06 23:59","","" +"cert_extlifeSpan","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not present","","" +"cert_crlDistributionPoints","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","","" +"cert_ocspURL","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","http://ocsp.sectigo.com","","" +"OCSP_stapling","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","","" +"cert_ocspRevoked","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not revoked","","" +"cert_mustStapleExtension","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","","" +"DNS_CAArecord","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","--","","" +"certificate_transparency","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","yes (certificate extension)","","" +"certs_countServer","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","4","","" +"certs_list_ordering_problem","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no","","" +"cert_caIssuers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","","" +"intermediate_cert <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","","" +"intermediate_cert_notBefore <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2036-03-21 23:59","","" +"intermediate_cert_expiration <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","","" +"intermediate_cert <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","","" +"intermediate_cert_notBefore <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","","" +"intermediate_cert <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","","" +"intermediate_cert_notBefore <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2010-02-01 00:00","","" +"intermediate_cert_notAfter <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","","" +"intermediate_cert_badOCSP","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","401 Unauthorized ('/') --","","" +"HTTP_clock_skew","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","1793778429","","" +"HSTS","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","not offered","","" +"HPKP","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","nginx/1.24.0 (Ubuntu)","","" +"banner_application","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No application banner found","","" +"cookie_count","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","0 at '/' (maybe missed the application)","","" +"Access-Control-Allow-Origin","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*","","" +"banner_reverseproxy","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","","CWE-200" +"heartbleed","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","no session ticket extension","CVE-2016-9244","CWE-200" +"ROBOT","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","supported","","CWE-310" +"secure_client_renego","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM-common_primes","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RFC7919/ffdhe2048","CVE-2015-4000","CWE-310" +"LOGJAM","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"BEAST","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2013-0169","CWE-310" +"winshock","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_X","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_11_12","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_13_14","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_15","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chrome_101_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chromium_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_100_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-ie_8_win7","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_11_win81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_11_winphone81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","","" +"clientsimulation-ie_11_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_15_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_101_win10_21h2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-edge_133_win11_23h2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_ios_184","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_154_osx_1231","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_osx_154","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_7u25","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","","" +"clientsimulation-java_80442","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1102","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1703","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_2106","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-go_1178","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-libressl_336","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","","" +"clientsimulation-openssl_102e","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_111d","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_315","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_350","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-apple_mail_16_0","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-thunderbird_91_9","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"rating_spec","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","100","","" +"protocol_support_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","30","","" +"key_exchange_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","90","","" +"key_exchange_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","27","","" +"cipher_strength_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","90","","" +"cipher_strength_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","36","","" +"final_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","93","","" +"overall_grade","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.html b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.html new file mode 100644 index 0000000..eb6bff4 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.html @@ -0,0 +1,229 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 08:46:41        -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--
+
+ rDNS (104.155.32.247):  --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            not offered
+ Strong encryption (AEAD ciphers) with no FS       not offered
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (no server order, thus listed by strength)
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ x9f     DHE-RSA-AES256-GCM-SHA384         DH 2048    AESGCM      256      TLS_DHE_RSA_WITH_AES_256_GCM_SHA384                
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xccaa   DHE-RSA-CHACHA20-POLY1305         DH 2048    ChaCha20    256      TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256          
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ x9e     DHE-RSA-AES128-GCM-SHA256         DH 2048    AESGCM      128      TLS_DHE_RSA_WITH_AES_128_GCM_SHA256                
+TLSv1.3 (no server order, thus listed by strength)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     no
+ (limited sense as client will pick)
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
+                              ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
+                              TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
+                              DHE-RSA-AES128-GCM-SHA256 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 X25519 
+ DH group offered:            ffdhe2048
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+                              RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "server name/#0" "max fragment length/#1" "status request/#5"
+                              "EC point formats/#11" "application layer protocol negotiation/#16"
+                              "extended master secret/#23" "supported versions/#43"
+                              "key share/#51" "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint no -- no lifetime advertised
+ SSL Session ID support       yes
+ Session Resumption           Tickets no, ID: yes
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication, TLS Web Client Authentication
+ Serial                       393425BF88EBDD03492962D4E9723D5E (OK: length 16)
+ Fingerprints                 SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
+                              SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Common Name (CN)             *.shelly.cloud 
+ subjectAltName (SAN)         *.shelly.cloud shelly.cloud 
+ Trust (hostname)             Ok via SAN wildcard and CN wildcard (same w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  --
+ OCSP URI                     http://ocsp.sectigo.com
+ OCSP stapling                offered, not revoked
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)
+ Intermediate cert validity   #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46
+                              #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority
+                              #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             401 Unauthorized
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                nginx/1.24.0 (Ubuntu)'
+ Application banner           --
+ Cookie(s)                    (none issued at "/") -- HTTP status 401 signals you maybe missed the web application
+ Security headers             Access-Control-Allow-Origin: *
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK), no session ticket extension
+ ROBOT                                     Server does not support any cipher suites that use RSA key transport
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: RFC7919/ffdhe2048 (2048 bits),
+                                           but no DH EXPORT ciphers
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     not vulnerable (OK)
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   DHE-RSA-AES256-GCM-SHA384         2048 bit DH  (ffdhe2048)
+ IE 11 Win 8.1                TLSv1.2   DHE-RSA-AES256-GCM-SHA384         2048 bit DH  (ffdhe2048)
+ IE 11 Win Phone 8.1          No connection
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 08:47:32 [  53s] -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.json b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.json new file mode 100644 index 0000000..1416f4d --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.json @@ -0,0 +1,785 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_cloud_120eu shelly-120-eu.shelly.cloud:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793778399", + "scanResult" : [ + { + "targetHost" : "shelly-120-eu.shelly.cloud", + "ip" : "104.155.32.247", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x9f", + "severity" : "OK", + "finding" : "TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xccaa", + "severity" : "OK", + "finding" : "TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x9e", + "severity" : "OK", + "finding" : "TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipher_order", + "severity" : "INFO", + "finding" : "NOT a server cipher order configured" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 X25519" + },{ + "id" : "DH_groups", + "severity" : "OK", + "finding" : "ffdhe2048" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "no -- no lifetime advertised" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "certificate_compression", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "SHA256 with RSA" + },{ + "id" : "cert_keySize", + "severity" : "INFO", + "finding" : "RSA 2048 bits (exponent is 65537)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature, Key Encipherment" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication, TLS Web Client Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "393425BF88EBDD03492962D4E9723D5E" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "16" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "*.shelly.cloud" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "*.shelly.cloud" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "*.shelly.cloud shelly.cloud" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)" + },{ + "id" : "cert_trust_wildcard", + "severity" : "LOW", + "finding" : "trust is via wildcard" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "63 >= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2025-12-07 00:00" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-06 23:59" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "http://ocsp.sectigo.com" + },{ + "id" : "OCSP_stapling", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cert_ocspRevoked", + "severity" : "OK", + "finding" : "not revoked" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2036-03-21 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2010-02-01 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "401 Unauthorized ('/') --" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793778429" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "nginx/1.24.0 (Ubuntu)" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/' (maybe missed the application)" + },{ + "id" : "Access-Control-Allow-Origin", + "severity" : "INFO", + "finding" : "*" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "no session ticket extension" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable, no RSA key transport cipher" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "LOGJAM-common_primes", + "severity" : "INFO", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "RFC7919/ffdhe2048" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "OK", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 53 +} diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.log b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.log new file mode 100644 index 0000000..c0e046d --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/443/des08_shelly_cloud_120eu_443.log @@ -0,0 +1,208 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_cloud_120eu shelly-120-eu.shelly.cloud:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 08:46:41 -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<-- + + rDNS (104.155.32.247): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) not offered + Strong encryption (AEAD ciphers) with no FS not offered + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (no server order, thus listed by strength) + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 +TLSv1.3 (no server order, thus listed by strength) + x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? no + (limited sense as client will pick) + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 + ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 + TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 + DHE-RSA-AES128-GCM-SHA256 + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 X25519 + DH group offered: ffdhe2048 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "server name/#0" "max fragment length/#1" "status request/#5" + "EC point formats/#11" "application layer protocol negotiation/#16" + "extended master secret/#23" "supported versions/#43" + "key share/#51" "renegotiation info/#65281" + Session Ticket RFC 5077 hint no -- no lifetime advertised + SSL Session ID support yes + Session Resumption Tickets no, ID: yes + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication + Serial 393425BF88EBDD03492962D4E9723D5E (OK: length 16) + Fingerprints SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7 + SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Common Name (CN) *.shelly.cloud  + subjectAltName (SAN) *.shelly.cloud shelly.cloud  + Trust (hostname) Ok via SAN wildcard and CN wildcard (same w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59) + ETS/"eTLS", visibility info not present + Certificate Revocation List -- + OCSP URI http://ocsp.sectigo.com + OCSP stapling offered, not revoked + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB) + Intermediate cert validity #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46 + #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority + #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  401 Unauthorized + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner nginx/1(B.2(B4(B.0(B (Ubuntu(B) + Application banner -- + Cookie(s) (none issued at "/") -- HTTP status 401 signals you maybe missed the web application + Security headers Access-Control-Allow-Origin: * + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), no session ticket extension + ROBOT Server does not support any cipher suites that use RSA key transport + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + LOGJAM (CVE-2015-4000), experimental common prime with 2048 bits detected: RFC7919/ffdhe2048 (2048 bits), + but no DH EXPORT ciphers + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH (ffdhe2048) + IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH (ffdhe2048) + IE 11 Win Phone 8.1 No connection + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 08:47:32 [ 53s] -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.csv b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.csv new file mode 100644 index 0000000..56a2684 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.csv @@ -0,0 +1,177 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","shelly-120-eu.shelly.cloud/104.155.32.247","6113","DEBUG","Couldn't determine service, skipping all HTTP checks","","" +"pre_128cipher","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No 128 cipher limit bug","","" +"SSLv2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","" +"SSLv3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","" +"TLS1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","","" +"TLS1_1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","","" +"TLS1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","","" +"TLS1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered with final","","" +"NPN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","","" +"ALPN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","http/1.1","","" +"cipherlist_NULL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327" +"cipherlist_aNULL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327" +"cipherlist_EXPORT","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327" +"cipherlist_LOW","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","","" +"cipherlist_STRONG_FS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","","" +"cipher_order-tls1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","","" +"cipher-tls1_2_xc02f","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc030","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc027","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_xc028","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","","" +"cipher-tls1_2_xcca8","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc061","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_xc060","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_xc014","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_xc013","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x9d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc09d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","","" +"cipher-tls1_2_xc051","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_x9c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc09c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","","" +"cipher-tls1_2_xc050","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_x3d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","","" +"cipher-tls1_2_x3c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_x35","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x2f","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipherorder_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","","" +"prioritize_chacha_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","false","","" +"cipher_order-tls1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","","" +"cipher-tls1_3_x1302","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"cipherorder_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"prioritize_chacha_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","false","","" +"cipher_order","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","","" +"FS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","","" +"FS_ciphers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","","" +"FS_KEMs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","X25519MLKEM768","","" +"FS_ECDHE_curves","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","prime256v1 secp384r1 secp521r1 X25519 X448","","" +"DH_groups","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ffdhe2048 ffdhe3072","","" +"FS_TLS12_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","","" +"FS_TLS13_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","","" +"TLS_extensions","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","valid for 7200 seconds only (= 60 days","","" +"cert_notBefore","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2025-12-07 00:00","","" +"cert_notAfter","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2027-01-06 23:59","","" +"cert_extlifeSpan","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not present","","" +"cert_crlDistributionPoints","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","--","","" +"cert_ocspURL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","http://ocsp.sectigo.com","","" +"OCSP_stapling","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","not offered","","" +"cert_mustStapleExtension","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","--","","" +"DNS_CAArecord","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","--","","" +"certificate_transparency","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","yes (certificate extension)","","" +"certs_countServer","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","4","","" +"certs_list_ordering_problem","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","no","","" +"cert_caIssuers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","","" +"intermediate_cert <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","","" +"intermediate_cert_notBefore <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2036-03-21 23:59","","" +"intermediate_cert_expiration <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","","" +"intermediate_cert <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","","" +"intermediate_cert_notBefore <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","","" +"intermediate_cert <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","","" +"intermediate_cert_notBefore <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2010-02-01 00:00","","" +"intermediate_cert_notAfter <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","","" +"intermediate_cert_badOCSP","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","intermediate certificate(s) is/are ok","","" +"heartbleed","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200" +"ROBOT","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","supported","","CWE-310" +"secure_client_renego","shelly-120-eu.shelly.cloud/104.155.32.247","6113","MEDIUM","VULNERABLE, potential DoS threat","CVE-2011-1473","CWE-310" +"CRIME_TLS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310" +"POODLE_SSL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_X","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_11_12","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_13_14","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_15","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-chrome_101_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-chromium_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-firefox_100_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-firefox_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-ie_8_win7","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No connection","","" +"clientsimulation-ie_11_win7","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_winphone81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-edge_133_win11_23h2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_184_ios_184","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_154_osx_1231","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_184_osx_154","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_7u25","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No connection","","" +"clientsimulation-java_80442","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1102","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1703","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_2106","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-go_1178","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-libressl_336","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_102e","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_315","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_350","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-apple_mail_16_0","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"rating_spec","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","100","","" +"protocol_support_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","30","","" +"key_exchange_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","90","","" +"key_exchange_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","27","","" +"cipher_strength_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","90","","" +"cipher_strength_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","36","","" +"final_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","93","","" +"overall_grade","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.html b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.html new file mode 100644 index 0000000..b26fde2 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.html @@ -0,0 +1,229 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 08:54:02        -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--
+
+ rDNS (104.155.32.247):  --
+ Service detected:       Couldn't determine what's running on port 6113, assuming no HTTP service => skipping all HTTP checks
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xc027   ECDHE-RSA-AES128-SHA256           ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256              
+ xc028   ECDHE-RSA-AES256-SHA384           ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc061   ECDHE-ARIA256-GCM-SHA384          ECDH 253   ARIAGCM     256      TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384             
+ xc060   ECDHE-ARIA128-GCM-SHA256          ECDH 253   ARIAGCM     128      TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256             
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ xc09d   AES256-CCM                        RSA        AESCCM      256      TLS_RSA_WITH_AES_256_CCM                           
+ xc051   ARIA256-GCM-SHA384                RSA        ARIAGCM     256      TLS_RSA_WITH_ARIA_256_GCM_SHA384                   
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ xc09c   AES128-CCM                        RSA        AESCCM      128      TLS_RSA_WITH_AES_128_CCM                           
+ xc050   ARIA128-GCM-SHA256                RSA        ARIAGCM     128      TLS_RSA_WITH_ARIA_128_GCM_SHA256                   
+ x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256                    
+ x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256                    
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+TLSv1.3 (server order)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH/MLKEM AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH/MLKEM ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH/MLKEM AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- TLS 1.3 and below
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
+                              ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
+                              ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
+                              ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256 
+ KEMs offered                 X25519MLKEM768 
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 X448 
+ Finite field group:          ffdhe2048 ffdhe3072
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+                              RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "max fragment length/#1" "EC point formats/#11"
+                              "application layer protocol negotiation/#16" "encrypt-then-mac/#22"
+                              "extended master secret/#23" "session ticket/#35"
+                              "supported versions/#43" "key share/#51" "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily
+ SSL Session ID support       yes
+ Session Resumption           Tickets: yes, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication, TLS Web Client Authentication
+ Serial                       393425BF88EBDD03492962D4E9723D5E (OK: length 16)
+ Fingerprints                 SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
+                              SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Common Name (CN)             *.shelly.cloud 
+ subjectAltName (SAN)         *.shelly.cloud shelly.cloud 
+ Trust (hostname)             Ok via SAN wildcard and CN wildcard (same w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  --
+ OCSP URI                     http://ocsp.sectigo.com
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)
+ Intermediate cert validity   #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46
+                              #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority
+                              #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  (applicable only for HTTP service)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     VULNERABLE (NOT ok), potential DoS threat
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK) (not using HTTP anyway)
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+Could not determine the protocol, only simulating generic clients.
+
+ Running client simulations via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 08:55:14 [  73s] -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.json b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.json new file mode 100644 index 0000000..1faa2e7 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.json @@ -0,0 +1,794 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_cloud_120eu_6133 shelly-120-eu.shelly.cloud:6113", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793778841", + "scanResult" : [ + { + "targetHost" : "shelly-120-eu.shelly.cloud", + "ip" : "104.155.32.247", + "port" : "6113", + "rDNS" : "--", + "service" : "Couldn't determine service, skipping all HTTP checks", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc027", + "severity" : "LOW", + "finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xc028", + "severity" : "LOW", + "finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc061", + "severity" : "OK", + "finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc060", + "severity" : "OK", + "finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc09d", + "severity" : "OK", + "finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM" + },{ + "id" : "cipher-tls1_2_xc051", + "severity" : "OK", + "finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc09c", + "severity" : "OK", + "finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM" + },{ + "id" : "cipher-tls1_2_xc050", + "severity" : "OK", + "finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x3d", + "severity" : "LOW", + "finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x3c", + "severity" : "LOW", + "finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipherorder_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "prioritize_chacha_TLSv1_3", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "OK", + "finding" : "X25519MLKEM768" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519 X448" + },{ + "id" : "DH_groups", + "severity" : "OK", + "finding" : "ffdhe2048 ffdhe3072" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "valid for 7200 seconds only (= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2025-12-07 00:00" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-06 23:59" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "http://ocsp.sectigo.com" + },{ + "id" : "OCSP_stapling", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2036-03-21 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2010-02-01 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "INFO", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not applicable, not HTTP" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "MEDIUM", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "VULNERABLE, potential DoS threat" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable (not using HTTP anyway)" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 73 +} diff --git a/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.log b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.log new file mode 100644 index 0000000..d257ddc --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_120eu/6113/des08_shelly_cloud_120eu_6133.log @@ -0,0 +1,208 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_cloud_120eu_6133 shelly-120-eu.shelly.cloud:6113" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 08:54:02 -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<-- + + rDNS (104.155.32.247): -- + Service detected: Couldn't determine what's running on port 6113, assuming no HTTP service => skipping all HTTP checks + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM + xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384 + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM + xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256 + x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256 + x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256 + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA +TLSv1.3 (server order) + x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- TLS 1.3 and below + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 + ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 + ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256 + KEMs offered X25519MLKEM768 + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 + Finite field group: ffdhe2048 ffdhe3072 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "max fragment length/#1" "EC point formats/#11" + "application layer protocol negotiation/#16" "encrypt-then-mac/#22" + "extended master secret/#23" "session ticket/#35" + "supported versions/#43" "key share/#51" "renegotiation info/#65281" + Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily + SSL Session ID support yes + Session Resumption Tickets: yes, ID: no + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication + Serial 393425BF88EBDD03492962D4E9723D5E (OK: length 16) + Fingerprints SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7 + SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Common Name (CN) *.shelly.cloud  + subjectAltName (SAN) *.shelly.cloud shelly.cloud  + Trust (hostname) Ok via SAN wildcard and CN wildcard (same w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59) + ETS/"eTLS", visibility info not present + Certificate Revocation List -- + OCSP URI http://ocsp.sectigo.com + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB) + Intermediate cert validity #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46 + #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority + #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority + Intermediate Bad OCSP (exp.) Ok + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. (applicable only for HTTP service) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), potential DoS threat + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) (not using HTTP anyway) + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + +Could not determine the protocol, only simulating generic clients. + + Running client simulations via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 08:55:14 [ 73s] -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.csv b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.csv new file mode 100644 index 0000000..2ed91c5 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.csv @@ -0,0 +1,166 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","control.shelly.cloud/34.95.90.149","443","INFO","HTTP","","" +"pre_128cipher","control.shelly.cloud/34.95.90.149","443","INFO","No 128 cipher limit bug","","" +"SSLv2","control.shelly.cloud/34.95.90.149","443","OK","not offered","","" +"SSLv3","control.shelly.cloud/34.95.90.149","443","OK","not offered","","" +"TLS1","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","" +"TLS1_1","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","" +"TLS1_2","control.shelly.cloud/34.95.90.149","443","OK","offered","","" +"TLS1_3","control.shelly.cloud/34.95.90.149","443","OK","offered with final","","" +"NPN","control.shelly.cloud/34.95.90.149","443","INFO","offered with grpc-exp, h2, http/1.1, http/1.0 (advertised)","","" +"ALPN_HTTP2","control.shelly.cloud/34.95.90.149","443","OK","h2","","" +"ALPN","control.shelly.cloud/34.95.90.149","443","INFO","http/1.1grpc-exp","","" +"cipherlist_NULL","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327" +"cipherlist_LOW","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","control.shelly.cloud/34.95.90.149","443","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","" +"cipherlist_STRONG_FS","control.shelly.cloud/34.95.90.149","443","OK","offered","","" +"cipher_order-tls1_2","control.shelly.cloud/34.95.90.149","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","","" +"cipher-tls1_2_xc02f","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xcca8","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc030","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc013","control.shelly.cloud/34.95.90.149","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_xc014","control.shelly.cloud/34.95.90.149","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipherorder_TLSv1_2","control.shelly.cloud/34.95.90.149","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA","","" +"prioritize_chacha_TLSv1_2","control.shelly.cloud/34.95.90.149","443","INFO","true","","" +"cipher_order-tls1_3","control.shelly.cloud/34.95.90.149","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_3_x1302","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_3","control.shelly.cloud/34.95.90.149","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"cipher_order","control.shelly.cloud/34.95.90.149","443","OK","server -- TLS 1.3 client determined","","" +"FS","control.shelly.cloud/34.95.90.149","443","OK","offered","","" +"FS_ciphers","control.shelly.cloud/34.95.90.149","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","","" +"FS_KEMs","control.shelly.cloud/34.95.90.149","443","OK","X25519MLKEM768","","" +"FS_ECDHE_curves","control.shelly.cloud/34.95.90.149","443","OK","prime256v1 secp384r1 X25519","","" +"FS_TLS12_sig_algs","control.shelly.cloud/34.95.90.149","443","LOW","RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1","","" +"FS_TLS13_sig_algs","control.shelly.cloud/34.95.90.149","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","","" +"TLS_extensions","control.shelly.cloud/34.95.90.149","443","INFO","'server name/#0' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'next protocol/#13172' 'renegotiation info/#65281'","","" +"TLS_session_ticket","control.shelly.cloud/34.95.90.149","443","LOW","valid for 100800 seconds (>daily)","","" +"SSL_sessionID_support","control.shelly.cloud/34.95.90.149","443","INFO","yes","","" +"sessionresumption_ticket","control.shelly.cloud/34.95.90.149","443","INFO","supported","","" +"sessionresumption_ID","control.shelly.cloud/34.95.90.149","443","INFO","not supported","","" +"TLS_timestamp","control.shelly.cloud/34.95.90.149","443","INFO","random","","" +"certificate_compression","control.shelly.cloud/34.95.90.149","443","INFO","none","","" +"clientAuth","control.shelly.cloud/34.95.90.149","443","INFO","none","","" +"cert_numbers","control.shelly.cloud/34.95.90.149","443","INFO","1","","" +"cert_signatureAlgorithm","control.shelly.cloud/34.95.90.149","443","OK","SHA256 with RSA","","" +"cert_keySize","control.shelly.cloud/34.95.90.149","443","INFO","RSA 2048 bits (exponent is 65537)","","" +"cert_keyUsage","control.shelly.cloud/34.95.90.149","443","INFO","Digital Signature, Key Encipherment","","" +"cert_extKeyUsage","control.shelly.cloud/34.95.90.149","443","INFO","TLS Web Server Authentication","","" +"cert_serialNumber","control.shelly.cloud/34.95.90.149","443","INFO","FBD73E92DBE13DC80A3FB4DD63E368DB","","" +"cert_serialNumberLen","control.shelly.cloud/34.95.90.149","443","INFO","16","","" +"cert_fingerprintSHA1","control.shelly.cloud/34.95.90.149","443","INFO","37515BC1C73B336535ED37F1CD9278384F9E0E98","","" +"cert_fingerprintSHA256","control.shelly.cloud/34.95.90.149","443","INFO","6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3","","" +"cert","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFFDCCA/ygAwIBAgIRAPvXPpLb4T3ICj+03WPjaNswDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoGA1UEAxMDV1IzMB4XDTI2MTAxODIzNDQ1NVoXDTI3MDExNzAwMzkyOVowHzEdMBsGA1UEAxMUY29udHJvbC5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbUihR957TsP8TL3V6Rqlf3ncgnYgSEFXgWjPhzlCCkOW3dyhfvXT+cJsF+8/CDVji0Os5PKmWijlL0mcv6iXzw4Oqls1yayq6mVLBpXLoqCvR5WtSGoceEFhELIPSBvhvGlXsab5gCkG+wIBkfelZT5A3oSpRUAVENz4sZN+Y1/4+iS2E+CDxRtVvuZrWKM90ZlCqjFeGvWb6FpMUfjse+1OHBxK53KIosggb/QECKuZFW+8pdo76aYkZyn6dKvlKK2LAL0O3bbRbj1TY79KYQ8CiUS5GGlaXsyFKnYht+el6jvLESoARAZLskdh+/6lPrBMjhlwN//D+iDEQ4HNhAgMBAAGjggItMIICKTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4VYfOqiY+fz7YO1R/DF8usWFNNowHwYDVR0jBBgwFoAUx4H1/Y6I2QA8TWOiUDEkoM4j/iMwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjMuY3J0MB8GA1UdEQQYMBaCFGNvbnRyb2wuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dyMy9IZUxMSkNnTHhoRS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaFRnmDgAAAEAwBHMEUCIEz7/8a+28tg2XIrDGjAS44EUvcbPZRSl6m1SVexCJG3AiEAkGPO4c9doniOhqoRz6e12hzO3QfDa8TAkpRdoBJ4DooAfwCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAaFRnmIUAAgAAAUAJ8ClvwQDAEgwRgIhAKSCz56h72qUgBghlI5rkkWcKAMfikzxU1Effie8NKK1AiEAt7xx/ZGBjLkPeM2ZkBEhaAJVRE1/w8h9x2JSsXfeMxIwDQYJKoZIhvcNAQELBQADggEBACpCa22KEenOoelJMLIhBihS5B++QtjVmhIO/dSKv1Qmj+LiIIUcvnS0MKgM8sxfpOwTkoinCtGrAnZn6pMpTbG6OMaa3EIOY1kxYhFhQ9XeVMpwwW/l/DU+jcGDr33pMixBFCscyO4rt4ljQmT/59MR3TVA8mPSqLJy0wHhEKXbthmliuiiR0CGABYMsi9u7Cc0MpmIZ94/GeHM0uMGmMf4A87Qa4k7niL5xOn09poZ5YGh9tZcffqUvO1IAVrdo6ZhRCCNl5z+nP1aDqXUtlk51tnt6Mn7OqXSAN8Mby8G7asj4jG1HVXMyQGfa5aGYtAyezLgBsXxdLnj4lq8xgY=\n-----END CERTIFICATE-----","","" +"cert_commonName","control.shelly.cloud/34.95.90.149","443","OK","control.shelly.cloud","","" +"cert_commonName_wo_SNI","control.shelly.cloud/34.95.90.149","443","INFO","control.shelly.cloud","","" +"cert_subjectAltName","control.shelly.cloud/34.95.90.149","443","INFO","control.shelly.cloud","","" +"cert_trust","control.shelly.cloud/34.95.90.149","443","OK","Ok via SAN and CN (same w/o SNI)","","" +"cert_chain_of_trust","control.shelly.cloud/34.95.90.149","443","OK","passed.","","" +"cert_certificatePolicies_EV","control.shelly.cloud/34.95.90.149","443","INFO","no","","" +"cert_expirationStatus","control.shelly.cloud/34.95.90.149","443","OK","73 >= 60 days","","" +"cert_notBefore","control.shelly.cloud/34.95.90.149","443","INFO","2026-10-18 23:44","","" +"cert_notAfter","control.shelly.cloud/34.95.90.149","443","OK","2027-01-17 00:39","","" +"cert_extlifeSpan","control.shelly.cloud/34.95.90.149","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","control.shelly.cloud/34.95.90.149","443","INFO","not present","","" +"cert_crlDistributionPoints","control.shelly.cloud/34.95.90.149","443","INFO","http://c.pki.goog/wr3/HeLLJCgLxhE.crl","","" +"cert_ocspURL","control.shelly.cloud/34.95.90.149","443","INFO","--","","" +"OCSP_stapling","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","" +"cert_mustStapleExtension","control.shelly.cloud/34.95.90.149","443","INFO","--","","" +"DNS_CAArecord","control.shelly.cloud/34.95.90.149","443","LOW","--","","" +"certificate_transparency","control.shelly.cloud/34.95.90.149","443","OK","yes (certificate extension)","","" +"certs_countServer","control.shelly.cloud/34.95.90.149","443","INFO","3","","" +"certs_list_ordering_problem","control.shelly.cloud/34.95.90.149","443","INFO","no","","" +"cert_caIssuers","control.shelly.cloud/34.95.90.149","443","INFO","WR3 (Google Trust Services from US)","","" +"intermediate_cert <#1>","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCzCCAvOgAwIBAgIQf/AFqRVo1jq8IoYWhKpLWjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPNHWHr4RyFI0HEJFvA6zx1Ag1mhnymxiJNGyYj3rU3eoF6N4bfIxUErp5ivsYDQ18nPO9OOSoXsYzy0aJb0ag6TdjjdzM1ZdOMq17HSMFufV7SUOY0LxXx1N4GLHtp1SyfIa+8FRFvIe6mVkd9LjbAPuBT0YrYl6xOqUqFyOsor7FjuVe/XEefaS0I30EUrI00t+ZrIfGTFlf+OZPjnWSwrIwRpLQtg3H5Iln/z9UlCdl4wHISiyEL2Vfza1c/aatQVvcTD8XlpF9qdg8Uyoc0ObUd+ZDSsK3+Eiiza1jtSVrlnIdgUVvhmnE5OZ4TDHmoX+nAXMKh++HiXLM08WNAgMBAAGjgf4wgfswDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHgfX9jojZADxNY6JQMSSgziP+IzAfBgNVHSMEGDAWgBTkrysmcRorSCeFL1JmLO/wiRNxPjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAKGGGh0dHA6Ly9pLnBraS5nb29nL3IxLmNydDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vYy5wa2kuZ29vZy9yL3IxLmNybDATBgNVHSAEDDAKMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAgEAnI1DlJQzSKcWbyXXrJSsgKMo6KG74TMqhsuTg67a0FX02752+eiJb5YsOJc8DVOHalwpOvbuPdl5BuAEgIK4Va7l9j3J9M1/EjeWjGTM3RoszmBJGu82oz6EWi5q75xeF+onJmh2Hm98a/yJAI/mODXq5LofYcQ9AffKP9ZMZu+YwW+/qHqyX2JhaOntvl7i8S+l1Y8CcKEqM1NFK4s4EBYPRFjZDawOHX7fSchbSMVPn5Nu04lrU6xufuZqRosEQw2o0UAyzDoyA52NXzJTWr1G2FVg/0A9hdrQ/6fe9G3167zKxNqXErs6MpHttEouGbpm2ftzrmcvruYxTfxc4G2GwBi3LFLozNpy042gDfXBzDyn1staWsy7+QnzMlR59Fz6jBOk5R4LT+ma0+KjnfRhMh5T2ucm69HkvNQtDZlVa1tLUlzs0zLEdQSehTCjZ6SYsGt2bMVK6dvtxzcyCP0QDUFnNXCwgw12+mGSkAuj4ORi8kMRpnL8UEjkNbdw9KL1eYbEC3D0GPue2Yk2AGhxkmcdm1BoOp05kYw/Nnqgh7QV8DKyBTUHbjH0pXlLiOsSOY+CLh1eTM+Do6rSjqGnDQeUXylZmPCmuveaw38IVnBaa6Eiz6pngZ1u6OeO/1UzfhmyTm0n0G+9JZ3KS2Mq08isNgXHLnhlHJaphpE=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","control.shelly.cloud/34.95.90.149","443","INFO","2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7","","" +"intermediate_cert_notBefore <#1>","control.shelly.cloud/34.95.90.149","443","INFO","2023-12-13 09:00","","" +"intermediate_cert_notAfter <#1>","control.shelly.cloud/34.95.90.149","443","OK","2029-02-20 14:00","","" +"intermediate_cert_expiration <#1>","control.shelly.cloud/34.95.90.149","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","control.shelly.cloud/34.95.90.149","443","INFO","WR3 <-- GTS Root R1","","" +"intermediate_cert <#2>","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFYjCCBEqgAwIBAgIQd70NbNs2+RrqIQ/E8FjTDTANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UECxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIwMDYxOTAwMDA0MloXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFIxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAthECix7joXebO9y/lD63ladAPKH9gvl9MgaCcfb2jH/76Nu8ai6Xl6OMS/kr9rH5zoQdsfnFl97vufKj6bwSiV6nqlKr+CMny6SxnGPb15l+8Ape62im9MZaRw1NEDPjTrETo8gYbEvs/AmQ351kKSUjB6G00j0uYODP0gmHu81I8E3CwnqIiru6z1kZ1q+PsAewnjHxgsHA3y6mbWwZDrXYfiYaRQM9sHmklCitD38m5agI/pboPGiUU+6DOogrFZYJsuB6jC511pzrp1Zkj5ZPaK49l8KEj8C8QMALXL32h7M1bKwYUH+E4EzNktMg6TO8UpmvMrUpsyUqtEj5cuHKZPfmghCN6J3Cioj6OGaK/GP5Afl4/Xtcd/p2h/rs37EOeZVXtL0m79YB0esWCruOC7XFxYpVq9Os6pFLKcwZpDIlTirxZUTQAs6qzkm06p98g7BAe+dDq6dso499iYH6TKX/1Y7DzkvgtdizjkXPdsDtQCv9Uw+wp9U7DbGKogPeMa3Md+pvez7W35EiEua++tgy/BBjFFFy3l3WFpO9KWgz7zpm7AeKJt8T11dleCfeXkkUAKIAf5qoIbapsZWwpbkNFhHax2xIPEDgfg1azVY80ZcFuctL7TlLnMQ/0lUTbiSw1nH69MG6zO0b9f6BQdgAmD06yK56mDcYBZUCAwEAAaOCATgwggE0MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTkrysmcRorSCeFL1JmLO/wiRNxPjAfBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzBgBggrBgEFBQcBAQRUMFIwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnBraS5nb29nL2dzcjEwKQYIKwYBBQUHMAKGHWh0dHA6Ly9wa2kuZ29vZy9nc3IxL2dzcjEuY3J0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwucGtpLmdvb2cvZ3NyMS9nc3IxLmNybDA7BgNVHSAENDAyMAgGBmeBDAECATAIBgZngQwBAgIwDQYLKwYBBAHWeQIFAwIwDQYLKwYBBAHWeQIFAwMwDQYJKoZIhvcNAQELBQADggEBADSkHrEoo9C0dhemMXoh6dFSPsjbdBZBiLg9NR3t5P+T4Vxfq7vqfM/b5A3Ri1fyJm9bvhdGaJQ3b2t6yMAYN/olUazsaL+yyEn9WprKASOshIArAoyZl+tJaox118fessmXn1hIVw41oeQa1v1vg4Fv74zPl6/AhSrw9U5pCZEt4Wi4wStz6dTZ/CLANx8LZh1J7QJVj2fhMtfTJr9w4z30Z209fOU0iOMy+qduBmpvvYuR7hZL6Dupszfnw0Skfths18dG9ZKb59UhvmaSGZRVbNQpsg3BZlvid0lIKO2d1xozclOzgjXPYovJJIultzkMu34qQb9Sz/yilrbCgj8=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","control.shelly.cloud/34.95.90.149","443","INFO","3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5","","" +"intermediate_cert_notBefore <#2>","control.shelly.cloud/34.95.90.149","443","INFO","2020-06-19 00:00","","" +"intermediate_cert_notAfter <#2>","control.shelly.cloud/34.95.90.149","443","OK","2028-01-28 00:00","","" +"intermediate_cert_expiration <#2>","control.shelly.cloud/34.95.90.149","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","control.shelly.cloud/34.95.90.149","443","INFO","GTS Root R1 <-- GlobalSign Root CA","","" +"intermediate_cert_badOCSP","control.shelly.cloud/34.95.90.149","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","control.shelly.cloud/34.95.90.149","443","INFO","200 OK ('/')","","" +"HTTP_clock_skew","control.shelly.cloud/34.95.90.149","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","control.shelly.cloud/34.95.90.149","443","INFO","1793778057","","" +"HSTS","control.shelly.cloud/34.95.90.149","443","LOW","not offered","","" +"HPKP","control.shelly.cloud/34.95.90.149","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","control.shelly.cloud/34.95.90.149","443","INFO","UploadServer","","" +"banner_application","control.shelly.cloud/34.95.90.149","443","INFO","No application banner found","","" +"cookie_count","control.shelly.cloud/34.95.90.149","443","INFO","0 at '/'","","" +"Cache-Control","control.shelly.cloud/34.95.90.149","443","INFO","no-transform, private, no-cache, no-store, must-revalidate, max-age=0","","" +"banner_reverseproxy","control.shelly.cloud/34.95.90.149","443","INFO","--","","CWE-200" +"heartbleed","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2016-9244","CWE-200" +"ROBOT","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","control.shelly.cloud/34.95.90.149","443","OK","supported","","CWE-310" +"secure_client_renego","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","control.shelly.cloud/34.95.90.149","443","MEDIUM","potentially VULNERABLE, gzip deflate compress br HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","control.shelly.cloud/34.95.90.149","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","control.shelly.cloud/34.95.90.149","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","control.shelly.cloud/34.95.90.149","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","control.shelly.cloud/34.95.90.149","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_X","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_11_12","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_13_14","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_15","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chrome_101_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chromium_137_win11","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_100_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_137_win11","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-ie_8_win7","control.shelly.cloud/34.95.90.149","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_winphone81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","","" +"clientsimulation-ie_11_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-edge_133_win11_23h2","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_ios_184","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_154_osx_1231","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_osx_154","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_7u25","control.shelly.cloud/34.95.90.149","443","INFO","No connection","","" +"clientsimulation-java_80442","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1102","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-java_1703","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_2106","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-go_1178","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-libressl_336","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","","" +"clientsimulation-openssl_102e","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_315","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_350","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-apple_mail_16_0","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"rating_spec","control.shelly.cloud/34.95.90.149","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","control.shelly.cloud/34.95.90.149","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","control.shelly.cloud/34.95.90.149","443","INFO","100","","" +"protocol_support_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","30","","" +"key_exchange_score","control.shelly.cloud/34.95.90.149","443","INFO","90","","" +"key_exchange_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","27","","" +"cipher_strength_score","control.shelly.cloud/34.95.90.149","443","INFO","90","","" +"cipher_strength_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","36","","" +"final_score","control.shelly.cloud/34.95.90.149","443","INFO","93","","" +"overall_grade","control.shelly.cloud/34.95.90.149","443","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.html b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.html new file mode 100644 index 0000000..66c9de2 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.html @@ -0,0 +1,225 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 08:40:32        -->> 34.95.90.149:443 (control.shelly.cloud) <<--
+
+ rDNS (34.95.90.149):    --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   grpc-exp, h2, http/1.1, http/1.0 (advertised)
+ ALPN/HTTP2 h2, http/1.1, grpc-exp (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       not offered
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+TLSv1.3 (no server order, thus listed by strength)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH/MLKEM AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH/MLKEM ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH/MLKEM AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- only for < TLS 1.3
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
+                              ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA 
+ KEMs offered                 X25519MLKEM768 
+ Elliptic curves offered:     prime256v1 secp384r1 X25519 
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 
+                              RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "server name/#0" "EC point formats/#11"
+                              "application layer protocol negotiation/#16"
+                              "extended master secret/#23" "session ticket/#35"
+                              "supported versions/#43" "key share/#51" "next protocol/#13172"
+                              "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 100800 seconds but: FS requires session ticket keys to be rotated < daily !
+ SSL Session ID support       yes
+ Session Resumption           Tickets: yes, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication
+ Serial                       FBD73E92DBE13DC80A3FB4DD63E368DB (OK: length 16)
+ Fingerprints                 SHA1 37515BC1C73B336535ED37F1CD9278384F9E0E98
+                              SHA256 6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
+ Common Name (CN)             control.shelly.cloud 
+ subjectAltName (SAN)         control.shelly.cloud 
+ Trust (hostname)             Ok via SAN and CN (same w/o SNI)
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   73 >= 60 days (2026-10-18 23:44 --> 2027-01-17 00:39)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  http://c.pki.goog/wr3/HeLLJCgLxhE.crl
+ OCSP URI                     --
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        3
+ Issuer                       WR3 (Google Trust Services from US)
+ Intermediate cert validity   #1: ok > 40 days (2029-02-20 14:00). WR3 <-- GTS Root R1
+                              #2: ok > 40 days (2028-01-28 00:00). GTS Root R1 <-- GlobalSign Root CA
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             200 OK
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                UploadServer'
+ Application banner           --
+ Cookie(s)                    (none issued at "/")
+ Security headers             Cache-Control: no-transform, private, no-cache, no-store,
+                                must-revalidate, max-age=0
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)
+ ROBOT                                     Server does not support any cipher suites that use RSA key transport
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    potentially NOT ok, "gzip deflate compress br" HTTP compression detected. - only supplied "/" tested
+                                           Can be ignored for static pages or if no secrets in the page
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            X25519MLKEM768
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_128_GCM_SHA256            X25519MLKEM768
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_128_GCM_SHA256            X25519MLKEM768
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA              256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_128_GCM_SHA256            X25519MLKEM768
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 08:41:24 [  53s] -->> 34.95.90.149:443 (control.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.json b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.json new file mode 100644 index 0000000..f9620f6 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.json @@ -0,0 +1,753 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_cloud_control control.shelly.cloud:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793778031", + "scanResult" : [ + { + "targetHost" : "control.shelly.cloud", + "ip" : "34.95.90.149", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "offered with grpc-exp, h2, http/1.1, http/1.0 (advertised)" + },{ + "id" : "ALPN_HTTP2", + "severity" : "OK", + "finding" : "h2" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1grpc-exp" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "true" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server -- TLS 1.3 client determined" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA" + },{ + "id" : "FS_KEMs", + "severity" : "OK", + "finding" : "X25519MLKEM768" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 X25519" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "LOW", + "finding" : "RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'server name/#0' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'next protocol/#13172' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "LOW", + "finding" : "valid for 100800 seconds (>daily)" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "certificate_compression", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "SHA256 with RSA" + },{ + "id" : "cert_keySize", + "severity" : "INFO", + "finding" : "RSA 2048 bits (exponent is 65537)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature, Key Encipherment" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "FBD73E92DBE13DC80A3FB4DD63E368DB" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "16" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "37515BC1C73B336535ED37F1CD9278384F9E0E98" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIFFDCCA/ygAwIBAgIRAPvXPpLb4T3ICj+03WPjaNswDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoGA1UEAxMDV1IzMB4XDTI2MTAxODIzNDQ1NVoXDTI3MDExNzAwMzkyOVowHzEdMBsGA1UEAxMUY29udHJvbC5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbUihR957TsP8TL3V6Rqlf3ncgnYgSEFXgWjPhzlCCkOW3dyhfvXT+cJsF+8/CDVji0Os5PKmWijlL0mcv6iXzw4Oqls1yayq6mVLBpXLoqCvR5WtSGoceEFhELIPSBvhvGlXsab5gCkG+wIBkfelZT5A3oSpRUAVENz4sZN+Y1/4+iS2E+CDxRtVvuZrWKM90ZlCqjFeGvWb6FpMUfjse+1OHBxK53KIosggb/QECKuZFW+8pdo76aYkZyn6dKvlKK2LAL0O3bbRbj1TY79KYQ8CiUS5GGlaXsyFKnYht+el6jvLESoARAZLskdh+/6lPrBMjhlwN//D+iDEQ4HNhAgMBAAGjggItMIICKTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4VYfOqiY+fz7YO1R/DF8usWFNNowHwYDVR0jBBgwFoAUx4H1/Y6I2QA8TWOiUDEkoM4j/iMwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjMuY3J0MB8GA1UdEQQYMBaCFGNvbnRyb2wuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dyMy9IZUxMSkNnTHhoRS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaFRnmDgAAAEAwBHMEUCIEz7/8a+28tg2XIrDGjAS44EUvcbPZRSl6m1SVexCJG3AiEAkGPO4c9doniOhqoRz6e12hzO3QfDa8TAkpRdoBJ4DooAfwCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAaFRnmIUAAgAAAUAJ8ClvwQDAEgwRgIhAKSCz56h72qUgBghlI5rkkWcKAMfikzxU1Effie8NKK1AiEAt7xx/ZGBjLkPeM2ZkBEhaAJVRE1/w8h9x2JSsXfeMxIwDQYJKoZIhvcNAQELBQADggEBACpCa22KEenOoelJMLIhBihS5B++QtjVmhIO/dSKv1Qmj+LiIIUcvnS0MKgM8sxfpOwTkoinCtGrAnZn6pMpTbG6OMaa3EIOY1kxYhFhQ9XeVMpwwW/l/DU+jcGDr33pMixBFCscyO4rt4ljQmT/59MR3TVA8mPSqLJy0wHhEKXbthmliuiiR0CGABYMsi9u7Cc0MpmIZ94/GeHM0uMGmMf4A87Qa4k7niL5xOn09poZ5YGh9tZcffqUvO1IAVrdo6ZhRCCNl5z+nP1aDqXUtlk51tnt6Mn7OqXSAN8Mby8G7asj4jG1HVXMyQGfa5aGYtAyezLgBsXxdLnj4lq8xgY=\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "control.shelly.cloud" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "control.shelly.cloud" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "control.shelly.cloud" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN and CN (same w/o SNI)" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "73 >= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2026-10-18 23:44" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-17 00:39" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "http://c.pki.goog/wr3/HeLLJCgLxhE.crl" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "OCSP_stapling", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "3" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "WR3 (Google Trust Services from US)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIFCzCCAvOgAwIBAgIQf/AFqRVo1jq8IoYWhKpLWjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPNHWHr4RyFI0HEJFvA6zx1Ag1mhnymxiJNGyYj3rU3eoF6N4bfIxUErp5ivsYDQ18nPO9OOSoXsYzy0aJb0ag6TdjjdzM1ZdOMq17HSMFufV7SUOY0LxXx1N4GLHtp1SyfIa+8FRFvIe6mVkd9LjbAPuBT0YrYl6xOqUqFyOsor7FjuVe/XEefaS0I30EUrI00t+ZrIfGTFlf+OZPjnWSwrIwRpLQtg3H5Iln/z9UlCdl4wHISiyEL2Vfza1c/aatQVvcTD8XlpF9qdg8Uyoc0ObUd+ZDSsK3+Eiiza1jtSVrlnIdgUVvhmnE5OZ4TDHmoX+nAXMKh++HiXLM08WNAgMBAAGjgf4wgfswDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHgfX9jojZADxNY6JQMSSgziP+IzAfBgNVHSMEGDAWgBTkrysmcRorSCeFL1JmLO/wiRNxPjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAKGGGh0dHA6Ly9pLnBraS5nb29nL3IxLmNydDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vYy5wa2kuZ29vZy9yL3IxLmNybDATBgNVHSAEDDAKMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAgEAnI1DlJQzSKcWbyXXrJSsgKMo6KG74TMqhsuTg67a0FX02752+eiJb5YsOJc8DVOHalwpOvbuPdl5BuAEgIK4Va7l9j3J9M1/EjeWjGTM3RoszmBJGu82oz6EWi5q75xeF+onJmh2Hm98a/yJAI/mODXq5LofYcQ9AffKP9ZMZu+YwW+/qHqyX2JhaOntvl7i8S+l1Y8CcKEqM1NFK4s4EBYPRFjZDawOHX7fSchbSMVPn5Nu04lrU6xufuZqRosEQw2o0UAyzDoyA52NXzJTWr1G2FVg/0A9hdrQ/6fe9G3167zKxNqXErs6MpHttEouGbpm2ftzrmcvruYxTfxc4G2GwBi3LFLozNpy042gDfXBzDyn1staWsy7+QnzMlR59Fz6jBOk5R4LT+ma0+KjnfRhMh5T2ucm69HkvNQtDZlVa1tLUlzs0zLEdQSehTCjZ6SYsGt2bMVK6dvtxzcyCP0QDUFnNXCwgw12+mGSkAuj4ORi8kMRpnL8UEjkNbdw9KL1eYbEC3D0GPue2Yk2AGhxkmcdm1BoOp05kYw/Nnqgh7QV8DKyBTUHbjH0pXlLiOsSOY+CLh1eTM+Do6rSjqGnDQeUXylZmPCmuveaw38IVnBaa6Eiz6pngZ1u6OeO/1UzfhmyTm0n0G+9JZ3KS2Mq08isNgXHLnhlHJaphpE=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2023-12-13 09:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2029-02-20 14:00" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "WR3 <-- GTS Root R1" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIFYjCCBEqgAwIBAgIQd70NbNs2+RrqIQ/E8FjTDTANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UECxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIwMDYxOTAwMDA0MloXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFIxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAthECix7joXebO9y/lD63ladAPKH9gvl9MgaCcfb2jH/76Nu8ai6Xl6OMS/kr9rH5zoQdsfnFl97vufKj6bwSiV6nqlKr+CMny6SxnGPb15l+8Ape62im9MZaRw1NEDPjTrETo8gYbEvs/AmQ351kKSUjB6G00j0uYODP0gmHu81I8E3CwnqIiru6z1kZ1q+PsAewnjHxgsHA3y6mbWwZDrXYfiYaRQM9sHmklCitD38m5agI/pboPGiUU+6DOogrFZYJsuB6jC511pzrp1Zkj5ZPaK49l8KEj8C8QMALXL32h7M1bKwYUH+E4EzNktMg6TO8UpmvMrUpsyUqtEj5cuHKZPfmghCN6J3Cioj6OGaK/GP5Afl4/Xtcd/p2h/rs37EOeZVXtL0m79YB0esWCruOC7XFxYpVq9Os6pFLKcwZpDIlTirxZUTQAs6qzkm06p98g7BAe+dDq6dso499iYH6TKX/1Y7DzkvgtdizjkXPdsDtQCv9Uw+wp9U7DbGKogPeMa3Md+pvez7W35EiEua++tgy/BBjFFFy3l3WFpO9KWgz7zpm7AeKJt8T11dleCfeXkkUAKIAf5qoIbapsZWwpbkNFhHax2xIPEDgfg1azVY80ZcFuctL7TlLnMQ/0lUTbiSw1nH69MG6zO0b9f6BQdgAmD06yK56mDcYBZUCAwEAAaOCATgwggE0MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTkrysmcRorSCeFL1JmLO/wiRNxPjAfBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzBgBggrBgEFBQcBAQRUMFIwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnBraS5nb29nL2dzcjEwKQYIKwYBBQUHMAKGHWh0dHA6Ly9wa2kuZ29vZy9nc3IxL2dzcjEuY3J0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwucGtpLmdvb2cvZ3NyMS9nc3IxLmNybDA7BgNVHSAENDAyMAgGBmeBDAECATAIBgZngQwBAgIwDQYLKwYBBAHWeQIFAwIwDQYLKwYBBAHWeQIFAwMwDQYJKoZIhvcNAQELBQADggEBADSkHrEoo9C0dhemMXoh6dFSPsjbdBZBiLg9NR3t5P+T4Vxfq7vqfM/b5A3Ri1fyJm9bvhdGaJQ3b2t6yMAYN/olUazsaL+yyEn9WprKASOshIArAoyZl+tJaox118fessmXn1hIVw41oeQa1v1vg4Fv74zPl6/AhSrw9U5pCZEt4Wi4wStz6dTZ/CLANx8LZh1J7QJVj2fhMtfTJr9w4z30Z209fOU0iOMy+qduBmpvvYuR7hZL6Dupszfnw0Skfths18dG9ZKb59UhvmaSGZRVbNQpsg3BZlvid0lIKO2d1xozclOzgjXPYovJJIultzkMu34qQb9Sz/yilrbCgj8=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2020-06-19 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2028-01-28 00:00" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "GTS Root R1 <-- GlobalSign Root CA" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "200 OK ('/')" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793778057" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "UploadServer" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/'" + },{ + "id" : "Cache-Control", + "severity" : "INFO", + "finding" : "no-transform, private, no-cache, no-store, must-revalidate, max-age=0" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not vulnerable" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable, no RSA key transport cipher" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "MEDIUM", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "potentially VULNERABLE, gzip deflate compress br HTTP compression detected - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 53 +} diff --git a/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.log b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.log new file mode 100644 index 0000000..e4107b7 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_cloud_control/des08_shelly_cloud_control.log @@ -0,0 +1,204 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_cloud_control control.shelly.cloud:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 08:40:32 -->> 34.95.90.149:443 (control.shelly.cloud) <<-- + + rDNS (34.95.90.149): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY grpc-exp, h2, http/1.1, http/1.0 (advertised) + ALPN/HTTP2 h2, http/1.1, grpc-exp (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS not offered + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order -- server prioritizes ChaCha ciphers when preferred by clients) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +TLSv1.3 (no server order, thus listed by strength) + x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- only for < TLS 1.3 + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA + ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA + KEMs offered X25519MLKEM768 + Elliptic curves offered: prime256v1 secp384r1 X25519 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 + RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "server name/#0" "EC point formats/#11" + "application layer protocol negotiation/#16" + "extended master secret/#23" "session ticket/#35" + "supported versions/#43" "key share/#51" "next protocol/#13172" + "renegotiation info/#65281" + Session Ticket RFC 5077 hint 100800 seconds but: FS requires session ticket keys to be rotated < daily ! + SSL Session ID support yes + Session Resumption Tickets: yes, ID: no + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication + Serial FBD73E92DBE13DC80A3FB4DD63E368DB (OK: length 16) + Fingerprints SHA1 37515BC1C73B336535ED37F1CD9278384F9E0E98 + SHA256 6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3 + Common Name (CN) control.shelly.cloud  + subjectAltName (SAN) control.shelly.cloud  + Trust (hostname) Ok via SAN and CN (same w/o SNI) + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 73 >= 60 days (2026-10-18 23:44 --> 2027-01-17 00:39) + ETS/"eTLS", visibility info not present + Certificate Revocation List http://c.pki.goog/wr3/HeLLJCgLxhE.crl + OCSP URI -- + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 3 + Issuer WR3 (Google Trust Services from US) + Intermediate cert validity #1: ok > 40 days (2029-02-20 14:00). WR3 <-- GTS Root R1 + #2: ok > 40 days (2028-01-28 00:00). GTS Root R1 <-- GlobalSign Root CA + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  200 OK + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner UploadServer + Application banner -- + Cookie(s) (none issued at "/") + Security headers Cache-Control: no-transform, private, no-cache, no-store, + must-revalidate, max-age=0 + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) + ROBOT Server does not support any cipher suites that use RSA key transport + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) potentially NOT ok, "gzip deflate compress br" HTTP compression detected. - only supplied "/" tested + Can be ignored for static pages or if no secrets in the page + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 X25519MLKEM768 + Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 X25519MLKEM768 + Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 X25519MLKEM768 + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 X25519MLKEM768 + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 08:41:24 [ 53s] -->> 34.95.90.149:443 (control.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.csv b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.csv new file mode 100644 index 0000000..75419ea --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.csv @@ -0,0 +1,189 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","HTTP","","" +"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No 128 cipher limit bug","","" +"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","" +"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","" +"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","" +"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","" +"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","","" +"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered + downgraded to weaker protocol","","" +"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","" +"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http/1.1","","" +"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327" +"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","","" +"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","","" +"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","","" +"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","","" +"cipher-tls1_2_xc077","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384","","" +"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_xc076","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256","","" +"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc0a1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8","","" +"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","","" +"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc0a0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8","","" +"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","","" +"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","","" +"cipher-tls1_2_xc0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256","","" +"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_xba","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256","","" +"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x84","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA","","" +"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x41","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA","","" +"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA","","" +"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","false","","" +"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","","" +"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","","" +"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256","","" +"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","No KEMs offered","","" +"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","","" +"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","","" +"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'","","" +"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","valid for 300 seconds only (= 60 days","","" +"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2025-12-07 00:00","","" +"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2027-01-06 23:59","","" +"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not present","","" +"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","","" +"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http://ocsp.sectigo.com","","" +"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","","" +"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","","" +"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","--","","" +"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","yes (certificate extension)","","" +"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","4","","" +"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","","" +"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","","" +"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","","" +"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2036-03-21 23:59","","" +"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","","" +"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","","" +"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","","" +"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","","" +"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2010-02-01 00:00","","" +"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","","" +"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","WARN","Unexpected 500 Internal Server Error @ '/'","","" +"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1793779728","","" +"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","","" +"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","nginx/1.24.0 (Ubuntu)","","" +"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No application banner found","","" +"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 at '/' (maybe missed the application)","","" +"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*","","" +"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","","CWE-200" +"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-9244","CWE-200" +"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","supported","","CWE-310" +"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","","" +"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","","" +"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","","" +"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","100","","" +"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","30","","" +"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","","" +"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","27","","" +"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","","" +"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","36","","" +"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","93","","" +"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","A-","","" +"grade_cap_warning_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS 1.3 is not supported","","" diff --git a/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.html b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.html new file mode 100644 index 0000000..afdccee --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.html @@ -0,0 +1,246 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 09:08:25        -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--
+
+ rDNS (35.205.173.252):  --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    not offered and downgraded to a weaker protocol
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order)
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc061   ECDHE-ARIA256-GCM-SHA384          ECDH 253   ARIAGCM     256      TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384             
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc060   ECDHE-ARIA128-GCM-SHA256          ECDH 253   ARIAGCM     128      TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256             
+ xc028   ECDHE-RSA-AES256-SHA384           ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384              
+ xc077   ECDHE-RSA-CAMELLIA256-SHA384      ECDH 253   Camellia    256      TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384         
+ xc027   ECDHE-RSA-AES128-SHA256           ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256              
+ xc076   ECDHE-RSA-CAMELLIA128-SHA256      ECDH 253   Camellia    128      TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256         
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ xc0a1   AES256-CCM8                       RSA        AESCCM8     256      TLS_RSA_WITH_AES_256_CCM_8                         
+ xc09d   AES256-CCM                        RSA        AESCCM      256      TLS_RSA_WITH_AES_256_CCM                           
+ xc051   ARIA256-GCM-SHA384                RSA        ARIAGCM     256      TLS_RSA_WITH_ARIA_256_GCM_SHA384                   
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ xc0a0   AES128-CCM8                       RSA        AESCCM8     128      TLS_RSA_WITH_AES_128_CCM_8                         
+ xc09c   AES128-CCM                        RSA        AESCCM      128      TLS_RSA_WITH_AES_128_CCM                           
+ xc050   ARIA128-GCM-SHA256                RSA        ARIAGCM     128      TLS_RSA_WITH_ARIA_128_GCM_SHA256                   
+ x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256                    
+ xc0     CAMELLIA256-SHA256                RSA        Camellia    256      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256               
+ x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256                    
+ xba     CAMELLIA128-SHA256                RSA        Camellia    128      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256               
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+ x84     CAMELLIA256-SHA                   RSA        Camellia    256      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA                  
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+ x41     CAMELLIA128-SHA                   RSA        Camellia    128      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA                  
+TLSv1.3
+ - 
+
+ Has server cipher order?     yes (OK)
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
+                              ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
+                              ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
+                              ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
+                              ECDHE-ARIA128-GCM-SHA256 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 X448 
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+                              RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "server name/#0" "max fragment length/#1" "EC point formats/#11"
+                              "application layer protocol negotiation/#16" "encrypt-then-mac/#22"
+                              "extended master secret/#23" "session ticket/#35"
+                              "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily
+ SSL Session ID support       yes
+ Session Resumption           Tickets: yes, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication, TLS Web Client Authentication
+ Serial                       393425BF88EBDD03492962D4E9723D5E (OK: length 16)
+ Fingerprints                 SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
+                              SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Common Name (CN)             *.shelly.cloud 
+ subjectAltName (SAN)         *.shelly.cloud shelly.cloud 
+ Trust (hostname)             Ok via SAN wildcard and CN wildcard (same w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  --
+ OCSP URI                     http://ocsp.sectigo.com
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)
+ Intermediate cert validity   #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46
+                              #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority
+                              #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             500 Internal Server Error. Oh, didn't expect "500 Internal Server Error"
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                nginx/1.24.0 (Ubuntu)'
+ Application banner           --
+ Cookie(s)                    (none issued at "/") -- HTTP status 500 signals you maybe missed the web application
+ Security headers             Access-Control-Allow-Origin: *
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK) - ARIA, CHACHA or CCM ciphers found
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES256-SHA384           256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES256-SHA384           256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A-
+ Grade warning                TLS 1.3 is not supported
+
+ Done 2026-11-04 09:09:28 [  64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.json b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.json new file mode 100644 index 0000000..240551b --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.json @@ -0,0 +1,845 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793779704", + "scanResult" : [ + { + "targetHost" : "shelly-infra1-eu.shelly.cloud", + "ip" : "35.205.173.252", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "INFO", + "finding" : "not offered + downgraded to weaker protocol" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc061", + "severity" : "OK", + "finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc060", + "severity" : "OK", + "finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc028", + "severity" : "LOW", + "finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" + },{ + "id" : "cipher-tls1_2_xc077", + "severity" : "LOW", + "finding" : "TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" + },{ + "id" : "cipher-tls1_2_xc027", + "severity" : "LOW", + "finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xc076", + "severity" : "LOW", + "finding" : "TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc0a1", + "severity" : "OK", + "finding" : "TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8" + },{ + "id" : "cipher-tls1_2_xc09d", + "severity" : "OK", + "finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM" + },{ + "id" : "cipher-tls1_2_xc051", + "severity" : "OK", + "finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc0a0", + "severity" : "OK", + "finding" : "TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8" + },{ + "id" : "cipher-tls1_2_xc09c", + "severity" : "OK", + "finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM" + },{ + "id" : "cipher-tls1_2_xc050", + "severity" : "OK", + "finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x3d", + "severity" : "LOW", + "finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xc0", + "severity" : "LOW", + "finding" : "TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x3c", + "severity" : "LOW", + "finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xba", + "severity" : "LOW", + "finding" : "TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x84", + "severity" : "LOW", + "finding" : "TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x41", + "severity" : "LOW", + "finding" : "TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519 X448" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "valid for 300 seconds only (= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2025-12-07 00:00" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-06 23:59" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "http://ocsp.sectigo.com" + },{ + "id" : "OCSP_stapling", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2036-03-21 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2010-02-01 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "WARN", + "finding" : "Unexpected 500 Internal Server Error @ '/'" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793779728" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "nginx/1.24.0 (Ubuntu)" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/' (maybe missed the application)" + },{ + "id" : "Access-Control-Allow-Origin", + "severity" : "INFO", + "finding" : "*" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not vulnerable" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A-" + },{ + "id" : "grade_cap_warning_1", + "severity" : "INFO", + "finding" : "TLS 1.3 is not supported" + } + ] + } + ], + "scanTime" : 64 +} diff --git a/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.log b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.log new file mode 100644 index 0000000..f8626d6 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/443/des08_shelly_infra_443.log @@ -0,0 +1,225 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<-- + + rDNS (35.205.173.252): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 not offered and downgraded to a weaker protocol + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order) + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8 + xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM + xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384 + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8 + xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM + xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256 + x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256 + xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256 + xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA + x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA + x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA +TLSv1.3 + - + + Has server cipher order? yes (OK) + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 + ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 + ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 + ECDHE-ARIA128-GCM-SHA256 + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "server name/#0" "max fragment length/#1" "EC point formats/#11" + "application layer protocol negotiation/#16" "encrypt-then-mac/#22" + "extended master secret/#23" "session ticket/#35" + "renegotiation info/#65281" + Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily + SSL Session ID support yes + Session Resumption Tickets: yes, ID: no + TLS clock skew Random values, no fingerprinting possible + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication + Serial 393425BF88EBDD03492962D4E9723D5E (OK: length 16) + Fingerprints SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7 + SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Common Name (CN) *.shelly.cloud  + subjectAltName (SAN) *.shelly.cloud shelly.cloud  + Trust (hostname) Ok via SAN wildcard and CN wildcard (same w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59) + ETS/"eTLS", visibility info not present + Certificate Revocation List -- + OCSP URI http://ocsp.sectigo.com + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB) + Intermediate cert validity #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46 + #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority + #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  500 Internal Server Error. Oh, didn't expect "500 Internal Server Error" + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner nginx/1(B.2(B4(B.0(B (Ubuntu(B) + Application banner -- + Cookie(s) (none issued at "/") -- HTTP status 500 signals you maybe missed the web application + Security headers Access-Control-Allow-Origin: * + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) - ARIA, CHACHA or CCM ciphers found + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A- + Grade warning TLS 1.3 is not supported + + Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.csv b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.csv new file mode 100644 index 0000000..925553a --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.csv @@ -0,0 +1,188 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","HTTP","","" +"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No 128 cipher limit bug","","" +"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","" +"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","" +"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","" +"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","" +"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","","" +"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered with final","","" +"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","" +"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http/1.1","","" +"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327" +"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327" +"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","offered","","CWE-310" +"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","","" +"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","","" +"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","","" +"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","","" +"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","","" +"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","","" +"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","","" +"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","","" +"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","","" +"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","","" +"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","","" +"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","","" +"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","","" +"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","","" +"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","","" +"cipher_order-tls1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","","" +"cipher-tls1_3_x1302","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"cipherorder_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"prioritize_chacha_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","","" +"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","","" +"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","","" +"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","","" +"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","X25519MLKEM768","","" +"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","","" +"DH_groups","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ffdhe2048 ffdhe3072","","" +"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","","" +"FS_TLS13_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","","" +"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","valid for 7200 seconds only (= 60 days","","" +"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2025-12-07 00:00","","" +"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2027-01-06 23:59","","" +"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not present","","" +"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","","" +"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http://ocsp.sectigo.com","","" +"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","","" +"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","","" +"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","--","","" +"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","yes (certificate extension)","","" +"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","4","","" +"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","","" +"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","","" +"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","","" +"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2036-03-21 23:59","","" +"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","","" +"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","","" +"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","","" +"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","","" +"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2010-02-01 00:00","","" +"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","","" +"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","404 Not Found ('/')","","" +"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1793779861","","" +"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","","" +"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No Server banner line in header, interesting!","","" +"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","X-Powered-By: Express","","" +"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 at '/' (maybe missed the application)","","" +"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*","","" +"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","","CWE-200" +"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-9244","CWE-200" +"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","supported","","CWE-310" +"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310" +"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310" +"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","","" +"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","","" +"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","","" +"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","100","","" +"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","30","","" +"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","","" +"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","27","","" +"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","","" +"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","36","","" +"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","93","","" +"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.html b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.html new file mode 100644 index 0000000..414490c --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.html @@ -0,0 +1,242 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 09:10:28        -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--
+
+ rDNS (35.205.173.252):  --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            offered
+ Strong encryption (AEAD ciphers) with no FS       offered (OK)
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (server order)
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ xc027   ECDHE-RSA-AES128-SHA256           ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256              
+ xc028   ECDHE-RSA-AES256-SHA384           ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384              
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xc061   ECDHE-ARIA256-GCM-SHA384          ECDH 253   ARIAGCM     256      TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384             
+ xc060   ECDHE-ARIA128-GCM-SHA256          ECDH 253   ARIAGCM     128      TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256             
+ xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
+ xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
+ x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384                    
+ xc09d   AES256-CCM                        RSA        AESCCM      256      TLS_RSA_WITH_AES_256_CCM                           
+ xc051   ARIA256-GCM-SHA384                RSA        ARIAGCM     256      TLS_RSA_WITH_ARIA_256_GCM_SHA384                   
+ x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256                    
+ xc09c   AES128-CCM                        RSA        AESCCM      128      TLS_RSA_WITH_AES_128_CCM                           
+ xc050   ARIA128-GCM-SHA256                RSA        ARIAGCM     128      TLS_RSA_WITH_ARIA_128_GCM_SHA256                   
+ x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256                    
+ x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256                    
+ x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
+ x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
+TLSv1.3 (server order)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH/MLKEM AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH/MLKEM ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH/MLKEM AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     yes (OK) -- TLS 1.3 and below
+
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
+                              ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
+                              ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
+                              ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
+                              ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256 
+ KEMs offered                 X25519MLKEM768 
+ Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 X448 
+ Finite field group:          ffdhe2048 ffdhe3072
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+                              RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "max fragment length/#1" "EC point formats/#11"
+                              "application layer protocol negotiation/#16" "encrypt-then-mac/#22"
+                              "extended master secret/#23" "session ticket/#35"
+                              "supported versions/#43" "key share/#51" "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily
+ SSL Session ID support       yes
+ Session Resumption           Tickets: yes, ID: no
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication, TLS Web Client Authentication
+ Serial                       393425BF88EBDD03492962D4E9723D5E (OK: length 16)
+ Fingerprints                 SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
+                              SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Common Name (CN)             *.shelly.cloud 
+ subjectAltName (SAN)         *.shelly.cloud shelly.cloud 
+ Trust (hostname)             Ok via SAN wildcard and CN wildcard (same w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  --
+ OCSP URI                     http://ocsp.sectigo.com
+ OCSP stapling                not offered
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)
+ Intermediate cert validity   #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46
+                              #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority
+                              #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                (no "Server" line in header, interesting!)
+ Application banner           X-Powered-By: Express'
+ Cookie(s)                    (none issued at "/") -- HTTP status 404 signals you maybe missed the web application
+ Security headers             Access-Control-Allow-Origin: *
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)
+ ROBOT                                     not vulnerable (OK)
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK) -- mitigated (disconnect after 4/10 attempts)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 8.1                TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win Phone 8.1          TLSv1.2   ECDHE-RSA-AES128-SHA256           256 bit ECDH (P-256)
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            X25519MLKEM768
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 09:11:41 [  74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.json b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.json new file mode 100644 index 0000000..92c11f8 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.json @@ -0,0 +1,841 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793779827", + "scanResult" : [ + { + "targetHost" : "shelly-infra1-eu.shelly.cloud", + "ip" : "35.205.173.252", + "port" : "9443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "LOW", + "cwe" : "CWE-310", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc027", + "severity" : "LOW", + "finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_xc028", + "severity" : "LOW", + "finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc061", + "severity" : "OK", + "finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc060", + "severity" : "OK", + "finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc014", + "severity" : "LOW", + "finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_xc013", + "severity" : "LOW", + "finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x9d", + "severity" : "OK", + "finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xc09d", + "severity" : "OK", + "finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM" + },{ + "id" : "cipher-tls1_2_xc051", + "severity" : "OK", + "finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x9c", + "severity" : "OK", + "finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_xc09c", + "severity" : "OK", + "finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM" + },{ + "id" : "cipher-tls1_2_xc050", + "severity" : "OK", + "finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x3d", + "severity" : "LOW", + "finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x3c", + "severity" : "LOW", + "finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256" + },{ + "id" : "cipher-tls1_2_x35", + "severity" : "LOW", + "finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA" + },{ + "id" : "cipher-tls1_2_x2f", + "severity" : "LOW", + "finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA" + },{ + "id" : "cipherorder_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA" + },{ + "id" : "prioritize_chacha_TLSv1_2", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "OK", + "finding" : "server" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipherorder_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "prioritize_chacha_TLSv1_3", + "severity" : "INFO", + "finding" : "false" + },{ + "id" : "cipher_order", + "severity" : "OK", + "finding" : "server" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "OK", + "finding" : "X25519MLKEM768" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 secp521r1 X25519 X448" + },{ + "id" : "DH_groups", + "severity" : "OK", + "finding" : "ffdhe2048 ffdhe3072" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "valid for 7200 seconds only (= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2025-12-07 00:00" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-06 23:59" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "http://ocsp.sectigo.com" + },{ + "id" : "OCSP_stapling", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2036-03-21 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2010-02-01 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "404 Not Found ('/')" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793779861" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "No Server banner line in header, interesting!" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "X-Powered-By: Express" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/' (maybe missed the application)" + },{ + "id" : "Access-Control-Allow-Origin", + "severity" : "INFO", + "finding" : "*" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "not vulnerable" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable, mitigated" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "LOGJAM-common_primes", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "no DH key with <= TLS 1.2" + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "LOW", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 74 +} diff --git a/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.log b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.log new file mode 100644 index 0000000..5c15c61 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_infra/9443/des08_shelly_infra_9443.log @@ -0,0 +1,221 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<-- + + rDNS (35.205.173.252): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) offered + Strong encryption (AEAD ciphers) with no FS offered (OK) + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (server order) + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384 + xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM + xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384 + x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256 + xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM + xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256 + x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256 + x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256 + x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA + x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA +TLSv1.3 (server order) + x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? yes (OK) -- TLS 1.3 and below + + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 + ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 + ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 + ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256 + KEMs offered X25519MLKEM768 + Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 + Finite field group: ffdhe2048 ffdhe3072 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "max fragment length/#1" "EC point formats/#11" + "application layer protocol negotiation/#16" "encrypt-then-mac/#22" + "extended master secret/#23" "session ticket/#35" + "supported versions/#43" "key share/#51" "renegotiation info/#65281" + Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily + SSL Session ID support yes + Session Resumption Tickets: yes, ID: no + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication + Serial 393425BF88EBDD03492962D4E9723D5E (OK: length 16) + Fingerprints SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7 + SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Common Name (CN) *.shelly.cloud  + subjectAltName (SAN) *.shelly.cloud shelly.cloud  + Trust (hostname) Ok via SAN wildcard and CN wildcard (same w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59) + ETS/"eTLS", visibility info not present + Certificate Revocation List -- + OCSP URI http://ocsp.sectigo.com + OCSP stapling not offered + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB) + Intermediate cert validity #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46 + #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority + #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  404 Not Found (Hint: supply a path which doesn't give a "404 Not Found") + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner (no "Server" line in header, interesting!) + Application banner X-Powered-By(B: Express + Cookie(s) (none issued at "/") -- HTTP status 404 signals you maybe missed the web application + Security headers Access-Control-Allow-Origin: * + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) + ROBOT not vulnerable (OK) + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) -- mitigated (disconnect after 4/10 attempts) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 256 bit ECDH (P-256) + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 X25519MLKEM768 + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<-- + + diff --git a/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.csv b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.csv new file mode 100644 index 0000000..cc84409 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.csv @@ -0,0 +1,174 @@ +"id","fqdn/ip","port","severity","finding","cve","cwe" +"service","repo.shelly.cloud/35.241.201.25","443","INFO","HTTP","","" +"pre_128cipher","repo.shelly.cloud/35.241.201.25","443","INFO","No 128 cipher limit bug","","" +"SSLv2","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","" +"SSLv3","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","" +"TLS1","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","" +"TLS1_1","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","" +"TLS1_2","repo.shelly.cloud/35.241.201.25","443","OK","offered","","" +"TLS1_3","repo.shelly.cloud/35.241.201.25","443","OK","offered with final","","" +"NPN","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","" +"ALPN","repo.shelly.cloud/35.241.201.25","443","INFO","http/1.1","","" +"cipherlist_NULL","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327" +"cipherlist_aNULL","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327" +"cipherlist_EXPORT","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327" +"cipherlist_LOW","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327" +"cipherlist_3DES_IDEA","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","CWE-310" +"cipherlist_OBSOLETED","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","CWE-310" +"cipherlist_STRONG_NOFS","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","" +"cipherlist_STRONG_FS","repo.shelly.cloud/35.241.201.25","443","OK","offered","","" +"cipher_order-tls1_2","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_2_xc030","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_x9f","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","","" +"cipher-tls1_2_xcca8","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xccaa","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_2_xc02f","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","","" +"cipher-tls1_2_x9e","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_2","repo.shelly.cloud/35.241.201.25","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","","" +"cipher_order-tls1_3","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a cipher order configured","","" +"cipher-tls1_3_x1302","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","","" +"cipher-tls1_3_x1303","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","","" +"cipher-tls1_3_x1301","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","","" +"supportedciphers_TLSv1_3","repo.shelly.cloud/35.241.201.25","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","","" +"cipher_order","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a server cipher order configured","","" +"FS","repo.shelly.cloud/35.241.201.25","443","OK","offered","","" +"FS_ciphers","repo.shelly.cloud/35.241.201.25","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","","" +"FS_KEMs","repo.shelly.cloud/35.241.201.25","443","LOW","No KEMs offered","","" +"FS_ECDHE_curves","repo.shelly.cloud/35.241.201.25","443","OK","prime256v1 secp384r1 X25519","","" +"DH_groups","repo.shelly.cloud/35.241.201.25","443","OK","ffdhe2048","","" +"FS_TLS12_sig_algs","repo.shelly.cloud/35.241.201.25","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224","","" +"FS_TLS13_sig_algs","repo.shelly.cloud/35.241.201.25","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","","" +"TLS_extensions","repo.shelly.cloud/35.241.201.25","443","INFO","'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","","" +"TLS_session_ticket","repo.shelly.cloud/35.241.201.25","443","INFO","no -- no lifetime advertised","","" +"SSL_sessionID_support","repo.shelly.cloud/35.241.201.25","443","INFO","yes","","" +"sessionresumption_ticket","repo.shelly.cloud/35.241.201.25","443","INFO","not supported","","" +"sessionresumption_ID","repo.shelly.cloud/35.241.201.25","443","INFO","supported","","" +"TLS_timestamp","repo.shelly.cloud/35.241.201.25","443","INFO","random","","" +"certificate_compression","repo.shelly.cloud/35.241.201.25","443","INFO","none","","" +"clientAuth","repo.shelly.cloud/35.241.201.25","443","INFO","none","","" +"cert_numbers","repo.shelly.cloud/35.241.201.25","443","INFO","1","","" +"cert_signatureAlgorithm","repo.shelly.cloud/35.241.201.25","443","OK","SHA256 with RSA","","" +"cert_keySize","repo.shelly.cloud/35.241.201.25","443","INFO","RSA 2048 bits (exponent is 65537)","","" +"cert_keyUsage","repo.shelly.cloud/35.241.201.25","443","INFO","Digital Signature, Key Encipherment","","" +"cert_extKeyUsage","repo.shelly.cloud/35.241.201.25","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","","" +"cert_serialNumber","repo.shelly.cloud/35.241.201.25","443","INFO","393425BF88EBDD03492962D4E9723D5E","","" +"cert_serialNumberLen","repo.shelly.cloud/35.241.201.25","443","INFO","16","","" +"cert_fingerprintSHA1","repo.shelly.cloud/35.241.201.25","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","","" +"cert_fingerprintSHA256","repo.shelly.cloud/35.241.201.25","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","","" +"cert","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","","" +"cert_commonName","repo.shelly.cloud/35.241.201.25","443","OK","*.shelly.cloud","","" +"cert_commonName_wo_SNI","repo.shelly.cloud/35.241.201.25","443","INFO","*.shelly.cloud","","" +"cert_subjectAltName","repo.shelly.cloud/35.241.201.25","443","INFO","*.shelly.cloud shelly.cloud","","" +"cert_trust","repo.shelly.cloud/35.241.201.25","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","","" +"cert_trust_wildcard","repo.shelly.cloud/35.241.201.25","443","LOW","trust is via wildcard","","" +"cert_chain_of_trust","repo.shelly.cloud/35.241.201.25","443","OK","passed.","","" +"cert_certificatePolicies_EV","repo.shelly.cloud/35.241.201.25","443","INFO","no","","" +"cert_expirationStatus","repo.shelly.cloud/35.241.201.25","443","OK","63 >= 60 days","","" +"cert_notBefore","repo.shelly.cloud/35.241.201.25","443","INFO","2025-12-07 00:00","","" +"cert_notAfter","repo.shelly.cloud/35.241.201.25","443","OK","2027-01-06 23:59","","" +"cert_extlifeSpan","repo.shelly.cloud/35.241.201.25","443","OK","certificate has no extended life time according to browser forum","","" +"cert_eTLS","repo.shelly.cloud/35.241.201.25","443","INFO","not present","","" +"cert_crlDistributionPoints","repo.shelly.cloud/35.241.201.25","443","INFO","--","","" +"cert_ocspURL","repo.shelly.cloud/35.241.201.25","443","INFO","http://ocsp.sectigo.com","","" +"OCSP_stapling","repo.shelly.cloud/35.241.201.25","443","OK","offered","","" +"cert_ocspRevoked","repo.shelly.cloud/35.241.201.25","443","OK","not revoked","","" +"cert_mustStapleExtension","repo.shelly.cloud/35.241.201.25","443","INFO","--","","" +"DNS_CAArecord","repo.shelly.cloud/35.241.201.25","443","LOW","--","","" +"certificate_transparency","repo.shelly.cloud/35.241.201.25","443","OK","yes (certificate extension)","","" +"certs_countServer","repo.shelly.cloud/35.241.201.25","443","INFO","4","","" +"certs_list_ordering_problem","repo.shelly.cloud/35.241.201.25","443","INFO","no","","" +"cert_caIssuers","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","","" +"intermediate_cert <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","","" +"intermediate_cert_notBefore <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#1>","repo.shelly.cloud/35.241.201.25","443","OK","2036-03-21 23:59","","" +"intermediate_cert_expiration <#1>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","","" +"intermediate_cert <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","","" +"intermediate_cert_notBefore <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","2021-03-22 00:00","","" +"intermediate_cert_notAfter <#2>","repo.shelly.cloud/35.241.201.25","443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#2>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","","" +"intermediate_cert <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","","" +"intermediate_cert_fingerprintSHA256 <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","","" +"intermediate_cert_notBefore <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","2010-02-01 00:00","","" +"intermediate_cert_notAfter <#3>","repo.shelly.cloud/35.241.201.25","443","OK","2038-01-18 23:59","","" +"intermediate_cert_expiration <#3>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","","" +"intermediate_cert_chain <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","","" +"intermediate_cert_badOCSP","repo.shelly.cloud/35.241.201.25","443","OK","intermediate certificate(s) is/are ok","","" +"HTTP_status_code","repo.shelly.cloud/35.241.201.25","443","INFO","401 Unauthorized ('/') --","","" +"HTTP_clock_skew","repo.shelly.cloud/35.241.201.25","443","INFO","0 seconds from localtime","","" +"HTTP_headerTime","repo.shelly.cloud/35.241.201.25","443","INFO","1793780243","","" +"HSTS","repo.shelly.cloud/35.241.201.25","443","LOW","not offered","","" +"HPKP","repo.shelly.cloud/35.241.201.25","443","INFO","No support for HTTP Public Key Pinning","","" +"banner_server","repo.shelly.cloud/35.241.201.25","443","INFO","nginx/1.24.0 (Ubuntu)","","" +"banner_application","repo.shelly.cloud/35.241.201.25","443","INFO","No application banner found","","" +"cookie_count","repo.shelly.cloud/35.241.201.25","443","INFO","0 at '/' (maybe missed the application)","","" +"Access-Control-Allow-Origin","repo.shelly.cloud/35.241.201.25","443","INFO","*","","" +"banner_reverseproxy","repo.shelly.cloud/35.241.201.25","443","INFO","--","","CWE-200" +"heartbleed","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119" +"CCS","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2014-0224","CWE-310" +"ticketbleed","repo.shelly.cloud/35.241.201.25","443","OK","no session ticket extension","CVE-2016-9244","CWE-200" +"ROBOT","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"secure_renego","repo.shelly.cloud/35.241.201.25","443","OK","supported","","CWE-310" +"secure_client_renego","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2011-1473","CWE-310" +"CRIME_TLS","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2012-4929","CWE-310" +"BREACH","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"POODLE_SSL","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"fallback_SCSV","repo.shelly.cloud/35.241.201.25","443","OK","no protocol below TLS 1.2 offered","","" +"SWEET32","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"FREAK","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2015-0204","CWE-310" +"DROWN","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","repo.shelly.cloud/35.241.201.25","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310" +"LOGJAM-common_primes","repo.shelly.cloud/35.241.201.25","443","INFO","RFC7919/ffdhe2048","CVE-2015-4000","CWE-310" +"LOGJAM","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"BEAST","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"LUCKY13","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2013-0169","CWE-310" +"winshock","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2014-6321","CWE-94" +"RC4","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"clientsimulation-android_70","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_81","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","","" +"clientsimulation-android_90","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_X","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_11_12","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_13_14","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-android_15","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chrome_101_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-chromium_137_win11","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_100_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-firefox_137_win11","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-ie_8_win7","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","","" +"clientsimulation-ie_11_win7","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_11_win81","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-ie_11_winphone81","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","","" +"clientsimulation-ie_11_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_15_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-edge_101_win10_21h2","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-edge_133_win11_23h2","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_ios_184","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_154_osx_1231","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-safari_184_osx_154","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_7u25","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","","" +"clientsimulation-java_80442","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_1102","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-java_1703","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-java_2106","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-go_1178","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"clientsimulation-libressl_336","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","","" +"clientsimulation-openssl_102e","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-openssl_111d","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_315","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-openssl_350","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","","" +"clientsimulation-apple_mail_16_0","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","","" +"clientsimulation-thunderbird_91_9","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","","" +"rating_spec","repo.shelly.cloud/35.241.201.25","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","","" +"rating_doc","repo.shelly.cloud/35.241.201.25","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","","" +"protocol_support_score","repo.shelly.cloud/35.241.201.25","443","INFO","100","","" +"protocol_support_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","30","","" +"key_exchange_score","repo.shelly.cloud/35.241.201.25","443","INFO","90","","" +"key_exchange_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","27","","" +"cipher_strength_score","repo.shelly.cloud/35.241.201.25","443","INFO","90","","" +"cipher_strength_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","36","","" +"final_score","repo.shelly.cloud/35.241.201.25","443","INFO","93","","" +"overall_grade","repo.shelly.cloud/35.241.201.25","443","OK","A+","","" diff --git a/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.html b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.html new file mode 100644 index 0000000..0067dca --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.html @@ -0,0 +1,229 @@ + + + + + + +testssl.sh + + +
+
+#####################################################################
+  testssl version 3.2.4 from https://testssl.sh/
+
+  This program is free software. Distribution and modification under
+  GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
+
+  Please file bugs @ https://testssl.sh/bugs/
+#####################################################################
+
+  Using OpenSSL 3.6.5 (Sep 29 2026)  [~103 ciphers]
+  on kali:/usr/bin/openssl
+
+ Start 2026-11-04 09:16:54        -->> 35.241.201.25:443 (repo.shelly.cloud) <<--
+
+ rDNS (35.241.201.25):   --
+ Service detected:       HTTP
+
+ Testing protocols via sockets except NPN+ALPN 
+
+ SSLv2      not offered (OK)
+ SSLv3      not offered (OK)
+ TLS 1      not offered
+ TLS 1.1    not offered
+ TLS 1.2    offered (OK)
+ TLS 1.3    offered (OK): final
+ NPN/SPDY   not offered
+ ALPN/HTTP2 http/1.1 (offered)
+
+ Testing cipher categories 
+
+ NULL ciphers (no encryption)                      not offered (OK)
+ Anonymous NULL Ciphers (no authentication)        not offered (OK)
+ Export ciphers (w/o ADH+NULL)                     not offered (OK)
+ LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      not offered (OK)
+ Triple DES Ciphers / IDEA                         not offered
+ Obsoleted CBC ciphers (AES, ARIA etc.)            not offered
+ Strong encryption (AEAD ciphers) with no FS       not offered
+ Forward Secrecy strong encryption (AEAD ciphers)  offered (OK)
+
+
+ Testing server's cipher preferences 
+
+Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
+-----------------------------------------------------------------------------------------------------------------------------
+SSLv2
+ - 
+SSLv3
+ - 
+TLSv1
+ - 
+TLSv1.1
+ - 
+TLSv1.2 (no server order, thus listed by strength)
+ xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384              
+ x9f     DHE-RSA-AES256-GCM-SHA384         DH 2048    AESGCM      256      TLS_DHE_RSA_WITH_AES_256_GCM_SHA384                
+ xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256        
+ xccaa   DHE-RSA-CHACHA20-POLY1305         DH 2048    ChaCha20    256      TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256          
+ xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256              
+ x9e     DHE-RSA-AES128-GCM-SHA256         DH 2048    AESGCM      128      TLS_DHE_RSA_WITH_AES_128_GCM_SHA256                
+TLSv1.3 (no server order, thus listed by strength)
+ x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384                             
+ x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256                       
+ x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256                             
+
+ Has server cipher order?     no
+ (limited sense as client will pick)
+
+ Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 
+
+ FS is offered (OK)           TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
+                              ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
+                              ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
+                              TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
+                              DHE-RSA-AES128-GCM-SHA256 
+ KEMs offered                 None
+ Elliptic curves offered:     prime256v1 secp384r1 X25519 
+ DH group offered:            ffdhe2048
+ TLS 1.2 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+                              RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224 
+ TLS 1.3 sig_algs offered:    RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 
+
+ Testing server defaults (Server Hello) 
+
+ TLS extensions (standard)    "server name/#0" "max fragment length/#1" "status request/#5"
+                              "EC point formats/#11" "application layer protocol negotiation/#16"
+                              "extended master secret/#23" "supported versions/#43"
+                              "key share/#51" "renegotiation info/#65281"
+ Session Ticket RFC 5077 hint no -- no lifetime advertised
+ SSL Session ID support       yes
+ Session Resumption           Tickets no, ID: yes
+ TLS clock skew               Random values, no fingerprinting possible 
+ Certificate Compression      none
+ Client Authentication        none
+ Signature Algorithm          SHA256 with RSA
+ Server key size              RSA 2048 bits (exponent is 65537)
+ Server key usage             Digital Signature, Key Encipherment
+ Server extended key usage    TLS Web Server Authentication, TLS Web Client Authentication
+ Serial                       393425BF88EBDD03492962D4E9723D5E (OK: length 16)
+ Fingerprints                 SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
+                              SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Common Name (CN)             *.shelly.cloud 
+ subjectAltName (SAN)         *.shelly.cloud shelly.cloud 
+ Trust (hostname)             Ok via SAN wildcard and CN wildcard (same w/o SNI)
+                              wildcard certificate could be problematic, see other hosts at
+                              https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ Chain of trust               Ok   
+ EV cert (experimental)       no 
+ Certificate Validity (UTC)   63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59)
+ ETS/"eTLS", visibility info  not present
+ Certificate Revocation List  --
+ OCSP URI                     http://ocsp.sectigo.com
+ OCSP stapling                offered, not revoked
+ OCSP must staple extension   --
+ DNS CAA RR (experimental)    not offered
+ Certificate Transparency     yes (certificate extension)
+ Certificates provided        4
+ Issuer                       Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)
+ Intermediate cert validity   #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46
+                              #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority
+                              #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority
+ Intermediate Bad OCSP (exp.) Ok
+
+
+ Testing HTTP header response @ "/" 
+
+ HTTP Status Code             401 Unauthorized
+ HTTP clock skew              0 sec from localtime
+ Strict Transport Security    not offered
+ Public Key Pinning           --
+ Server banner                nginx/1.24.0 (Ubuntu)'
+ Application banner           --
+ Cookie(s)                    (none issued at "/") -- HTTP status 401 signals you maybe missed the web application
+ Security headers             Access-Control-Allow-Origin: *
+ Reverse Proxy banner         --
+
+
+ Testing vulnerabilities 
+
+ Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
+ CCS (CVE-2014-0224)                       not vulnerable (OK)
+ Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK), no session ticket extension
+ ROBOT                                     Server does not support any cipher suites that use RSA key transport
+ Secure Renegotiation (RFC 5746)           supported (OK)
+ Secure Client-Initiated Renegotiation     not vulnerable (OK)
+ CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
+ BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
+ POODLE, SSL (CVE-2014-3566)               not vulnerable (OK), no SSLv3 support
+ TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
+ SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
+ FREAK (CVE-2015-0204)                     not vulnerable (OK)
+ DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
+                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
+                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
+ LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: RFC7919/ffdhe2048 (2048 bits),
+                                           but no DH EXPORT ciphers
+ BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
+ LUCKY13 (CVE-2013-0169), experimental     not vulnerable (OK)
+ Winshock (CVE-2014-6321), experimental    not vulnerable (OK)
+ RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)
+
+
+ Running client simulations (HTTP) via sockets 
+
+ Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
+------------------------------------------------------------------------------------------------
+ Android 7.0 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
+ Android 8.1 (native)         TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       253 bit ECDH (X25519)
+ Android 9.0 (native)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 10.0 (native)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 11/12 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 13/14 (native)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Android 15 (native)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chrome 101 (Win 10)          TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Chromium 137 (Win 11)        TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 100 (Win 10)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Firefox 137 (Win 11)         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ IE 8 Win 7                   No connection
+ IE 11 Win 7                  TLSv1.2   DHE-RSA-AES256-GCM-SHA384         2048 bit DH  (ffdhe2048)
+ IE 11 Win 8.1                TLSv1.2   DHE-RSA-AES256-GCM-SHA384         2048 bit DH  (ffdhe2048)
+ IE 11 Win Phone 8.1          No connection
+ IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
+ Edge 101 Win 10 21H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Edge 133 Win 11 23H2         TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (iOS 18.4)       TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 15.4 (macOS 12.3.1)   TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Safari 18.4 (macOS 15.4)     TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ Java 7u25                    No connection
+ Java 8u442 (OpenJDK)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 11.0.2 (OpenJDK)        TLSv1.3   TLS_AES_128_GCM_SHA256            256 bit ECDH (P-256)
+ Java 17.0.3 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Java 21.0.6 (OpenJDK)        TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ go 1.17.8                    TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+ LibreSSL 3.3.6 (macOS)       TLSv1.3   TLS_CHACHA20_POLY1305_SHA256      253 bit ECDH (X25519)
+ OpenSSL 1.0.2e               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ OpenSSL 1.1.1d (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.0.15 (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ OpenSSL 3.5.0 (git)          TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
+ Apple Mail (16.0)            TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
+ Thunderbird (91.9)           TLSv1.3   TLS_AES_128_GCM_SHA256            253 bit ECDH (X25519)
+
+
+ Rating (experimental) 
+
+ Rating specs (not complete)  SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
+ Specification documentation  https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
+ Protocol Support (weighted)  100 (30)
+ Key Exchange     (weighted)  90 (27)
+ Cipher Strength  (weighted)  90 (36)
+ Final Score                  93
+ Overall Grade                A+
+
+ Done 2026-11-04 09:17:46 [  53s] -->> 35.241.201.25:443 (repo.shelly.cloud) <<--
+
+
+
+ + diff --git a/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.json b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.json new file mode 100644 index 0000000..33d921e --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.json @@ -0,0 +1,785 @@ +{ + "Invocation" : "testssl -oA testssl/des08_shelly_repo repo.shelly.cloud:443", + "at" : "kali:/usr/bin/openssl", + "version" : "3.2.4 ", + "openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026", + "startTime" : "1793780213", + "scanResult" : [ + { + "targetHost" : "repo.shelly.cloud", + "ip" : "35.241.201.25", + "port" : "443", + "rDNS" : "--", + "service" : "HTTP", + "pretest" : [ + { + "id" : "pre_128cipher", + "severity" : "INFO", + "finding" : "No 128 cipher limit bug" + } + ], + "protocols" : [ + { + "id" : "SSLv2", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "SSLv3", + "severity" : "OK", + "finding" : "not offered" + },{ + "id" : "TLS1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_1", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "TLS1_2", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "TLS1_3", + "severity" : "OK", + "finding" : "offered with final" + },{ + "id" : "NPN", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "ALPN", + "severity" : "INFO", + "finding" : "http/1.1" + } + ], + "grease" : [ + + ], + "ciphers" : [ + { + "id" : "cipherlist_NULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_aNULL", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_EXPORT", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_LOW", + "severity" : "OK", + "cwe" : "CWE-327", + "finding" : "not offered" + },{ + "id" : "cipherlist_3DES_IDEA", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_OBSOLETED", + "severity" : "INFO", + "cwe" : "CWE-310", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_NOFS", + "severity" : "INFO", + "finding" : "not offered" + },{ + "id" : "cipherlist_STRONG_FS", + "severity" : "OK", + "finding" : "offered" + } + ], + "serverPreferences" : [ + { + "id" : "cipher_order-tls1_2", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_2_xc030", + "severity" : "OK", + "finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_x9f", + "severity" : "OK", + "finding" : "TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_2_xcca8", + "severity" : "OK", + "finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xccaa", + "severity" : "OK", + "finding" : "TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_2_xc02f", + "severity" : "OK", + "finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "cipher-tls1_2_x9e", + "severity" : "OK", + "finding" : "TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_2", + "severity" : "INFO", + "finding" : "ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "cipher_order-tls1_3", + "severity" : "INFO", + "finding" : "NOT a cipher order configured" + },{ + "id" : "cipher-tls1_3_x1302", + "severity" : "OK", + "finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384" + },{ + "id" : "cipher-tls1_3_x1303", + "severity" : "OK", + "finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "cipher-tls1_3_x1301", + "severity" : "OK", + "finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256" + },{ + "id" : "supportedciphers_TLSv1_3", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256" + },{ + "id" : "cipher_order", + "severity" : "INFO", + "finding" : "NOT a server cipher order configured" + } + ], + "fs" : [ + { + "id" : "FS", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "FS_ciphers", + "severity" : "INFO", + "finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "FS_KEMs", + "severity" : "LOW", + "finding" : "No KEMs offered" + },{ + "id" : "FS_ECDHE_curves", + "severity" : "OK", + "finding" : "prime256v1 secp384r1 X25519" + },{ + "id" : "DH_groups", + "severity" : "OK", + "finding" : "ffdhe2048" + },{ + "id" : "FS_TLS12_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224" + },{ + "id" : "FS_TLS13_sig_algs", + "severity" : "INFO", + "finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256" + } + ], + "serverDefaults" : [ + { + "id" : "TLS_extensions", + "severity" : "INFO", + "finding" : "'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'" + },{ + "id" : "TLS_session_ticket", + "severity" : "INFO", + "finding" : "no -- no lifetime advertised" + },{ + "id" : "SSL_sessionID_support", + "severity" : "INFO", + "finding" : "yes" + },{ + "id" : "sessionresumption_ticket", + "severity" : "INFO", + "finding" : "not supported" + },{ + "id" : "sessionresumption_ID", + "severity" : "INFO", + "finding" : "supported" + },{ + "id" : "TLS_timestamp", + "severity" : "INFO", + "finding" : "random" + },{ + "id" : "certificate_compression", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "clientAuth", + "severity" : "INFO", + "finding" : "none" + },{ + "id" : "cert_numbers", + "severity" : "INFO", + "finding" : "1" + },{ + "id" : "cert_signatureAlgorithm", + "severity" : "OK", + "finding" : "SHA256 with RSA" + },{ + "id" : "cert_keySize", + "severity" : "INFO", + "finding" : "RSA 2048 bits (exponent is 65537)" + },{ + "id" : "cert_keyUsage", + "severity" : "INFO", + "finding" : "Digital Signature, Key Encipherment" + },{ + "id" : "cert_extKeyUsage", + "severity" : "INFO", + "finding" : "TLS Web Server Authentication, TLS Web Client Authentication" + },{ + "id" : "cert_serialNumber", + "severity" : "INFO", + "finding" : "393425BF88EBDD03492962D4E9723D5E" + },{ + "id" : "cert_serialNumberLen", + "severity" : "INFO", + "finding" : "16" + },{ + "id" : "cert_fingerprintSHA1", + "severity" : "INFO", + "finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7" + },{ + "id" : "cert_fingerprintSHA256", + "severity" : "INFO", + "finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "cert", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----" + },{ + "id" : "cert_commonName", + "severity" : "OK", + "finding" : "*.shelly.cloud" + },{ + "id" : "cert_commonName_wo_SNI", + "severity" : "INFO", + "finding" : "*.shelly.cloud" + },{ + "id" : "cert_subjectAltName", + "severity" : "INFO", + "finding" : "*.shelly.cloud shelly.cloud" + },{ + "id" : "cert_trust", + "severity" : "OK", + "finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)" + },{ + "id" : "cert_trust_wildcard", + "severity" : "LOW", + "finding" : "trust is via wildcard" + },{ + "id" : "cert_chain_of_trust", + "severity" : "OK", + "finding" : "passed." + },{ + "id" : "cert_certificatePolicies_EV", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_expirationStatus", + "severity" : "OK", + "finding" : "63 >= 60 days" + },{ + "id" : "cert_notBefore", + "severity" : "INFO", + "finding" : "2025-12-07 00:00" + },{ + "id" : "cert_notAfter", + "severity" : "OK", + "finding" : "2027-01-06 23:59" + },{ + "id" : "cert_extlifeSpan", + "severity" : "OK", + "finding" : "certificate has no extended life time according to browser forum" + },{ + "id" : "cert_eTLS", + "severity" : "INFO", + "finding" : "not present" + },{ + "id" : "cert_crlDistributionPoints", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "cert_ocspURL", + "severity" : "INFO", + "finding" : "http://ocsp.sectigo.com" + },{ + "id" : "OCSP_stapling", + "severity" : "OK", + "finding" : "offered" + },{ + "id" : "cert_ocspRevoked", + "severity" : "OK", + "finding" : "not revoked" + },{ + "id" : "cert_mustStapleExtension", + "severity" : "INFO", + "finding" : "--" + },{ + "id" : "DNS_CAArecord", + "severity" : "LOW", + "finding" : "--" + },{ + "id" : "certificate_transparency", + "severity" : "OK", + "finding" : "yes (certificate extension)" + },{ + "id" : "certs_countServer", + "severity" : "INFO", + "finding" : "4" + },{ + "id" : "certs_list_ordering_problem", + "severity" : "INFO", + "finding" : "no" + },{ + "id" : "cert_caIssuers", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)" + },{ + "id" : "intermediate_cert <#1>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#1>", + "severity" : "INFO", + "finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0" + },{ + "id" : "intermediate_cert_notBefore <#1>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#1>", + "severity" : "OK", + "finding" : "2036-03-21 23:59" + },{ + "id" : "intermediate_cert_expiration <#1>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#1>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46" + },{ + "id" : "intermediate_cert <#2>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#2>", + "severity" : "INFO", + "finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5" + },{ + "id" : "intermediate_cert_notBefore <#2>", + "severity" : "INFO", + "finding" : "2021-03-22 00:00" + },{ + "id" : "intermediate_cert_notAfter <#2>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#2>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#2>", + "severity" : "INFO", + "finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert <#3>", + "severity" : "INFO", + "finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----" + },{ + "id" : "intermediate_cert_fingerprintSHA256 <#3>", + "severity" : "INFO", + "finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2" + },{ + "id" : "intermediate_cert_notBefore <#3>", + "severity" : "INFO", + "finding" : "2010-02-01 00:00" + },{ + "id" : "intermediate_cert_notAfter <#3>", + "severity" : "OK", + "finding" : "2038-01-18 23:59" + },{ + "id" : "intermediate_cert_expiration <#3>", + "severity" : "OK", + "finding" : "ok > 40 days" + },{ + "id" : "intermediate_cert_chain <#3>", + "severity" : "INFO", + "finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority" + },{ + "id" : "intermediate_cert_badOCSP", + "severity" : "OK", + "finding" : "intermediate certificate(s) is/are ok" + } + ], + "headerResponse" : [ + { + "id" : "HTTP_status_code", + "severity" : "INFO", + "finding" : "401 Unauthorized ('/') --" + },{ + "id" : "HTTP_clock_skew", + "severity" : "INFO", + "finding" : "0 seconds from localtime" + },{ + "id" : "HTTP_headerTime", + "severity" : "INFO", + "finding" : "1793780243" + },{ + "id" : "HSTS", + "severity" : "LOW", + "finding" : "not offered" + },{ + "id" : "HPKP", + "severity" : "INFO", + "finding" : "No support for HTTP Public Key Pinning" + },{ + "id" : "banner_server", + "severity" : "INFO", + "finding" : "nginx/1.24.0 (Ubuntu)" + },{ + "id" : "banner_application", + "severity" : "INFO", + "finding" : "No application banner found" + },{ + "id" : "cookie_count", + "severity" : "INFO", + "finding" : "0 at '/' (maybe missed the application)" + },{ + "id" : "Access-Control-Allow-Origin", + "severity" : "INFO", + "finding" : "*" + },{ + "id" : "banner_reverseproxy", + "severity" : "INFO", + "cwe" : "CWE-200", + "finding" : "--" + } + ], + "vulnerabilities" : [ + { + "id" : "heartbleed", + "severity" : "OK", + "cve" : "CVE-2014-0160", + "cwe" : "CWE-119", + "finding" : "not vulnerable, no heartbeat extension" + },{ + "id" : "CCS", + "severity" : "OK", + "cve" : "CVE-2014-0224", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "ticketbleed", + "severity" : "OK", + "cve" : "CVE-2016-9244", + "cwe" : "CWE-200", + "finding" : "no session ticket extension" + },{ + "id" : "ROBOT", + "severity" : "OK", + "cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168", + "cwe" : "CWE-203", + "finding" : "not vulnerable, no RSA key transport cipher" + },{ + "id" : "secure_renego", + "severity" : "OK", + "cwe" : "CWE-310", + "finding" : "supported" + },{ + "id" : "secure_client_renego", + "severity" : "OK", + "cve" : "CVE-2011-1473", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "CRIME_TLS", + "severity" : "OK", + "cve" : "CVE-2012-4929", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "BREACH", + "severity" : "OK", + "cve" : "CVE-2013-3587", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested" + },{ + "id" : "POODLE_SSL", + "severity" : "OK", + "cve" : "CVE-2014-3566", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no SSLv3" + },{ + "id" : "fallback_SCSV", + "severity" : "OK", + "finding" : "no protocol below TLS 1.2 offered" + },{ + "id" : "SWEET32", + "severity" : "OK", + "cve" : "CVE-2016-2183 CVE-2016-6329", + "cwe" : "CWE-327", + "finding" : "not vulnerable" + },{ + "id" : "FREAK", + "severity" : "OK", + "cve" : "CVE-2015-0204", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "DROWN", + "severity" : "OK", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "not vulnerable on this host and port" + },{ + "id" : "DROWN_hint", + "severity" : "INFO", + "cve" : "CVE-2016-0800 CVE-2016-0703", + "cwe" : "CWE-310", + "finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" + },{ + "id" : "LOGJAM-common_primes", + "severity" : "INFO", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "RFC7919/ffdhe2048" + },{ + "id" : "LOGJAM", + "severity" : "OK", + "cve" : "CVE-2015-4000", + "cwe" : "CWE-310", + "finding" : "not vulnerable, no DH EXPORT ciphers," + },{ + "id" : "BEAST", + "severity" : "OK", + "cve" : "CVE-2011-3389", + "cwe" : "CWE-20", + "finding" : "not vulnerable, no SSL3 or TLS1" + },{ + "id" : "LUCKY13", + "severity" : "OK", + "cve" : "CVE-2013-0169", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + },{ + "id" : "winshock", + "severity" : "OK", + "cve" : "CVE-2014-6321", + "cwe" : "CWE-94", + "finding" : "not vulnerable" + },{ + "id" : "RC4", + "severity" : "OK", + "cve" : "CVE-2013-2566 CVE-2015-2808", + "cwe" : "CWE-310", + "finding" : "not vulnerable" + } + ], + "cipherTests" : [ + + ], + "browserSimulations": [ + { + "id" : "clientsimulation-android_70", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_81", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256" + },{ + "id" : "clientsimulation-android_90", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_X", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_11_12", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_13_14", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-android_15", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chrome_101_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-chromium_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_100_win10", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-firefox_137_win11", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-ie_8_win7", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win7", + "severity" : "INFO", + "finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_11_win81", + "severity" : "INFO", + "finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-ie_11_winphone81", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-ie_11_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_15_win10", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-edge_101_win10_21h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-edge_133_win11_23h2", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_ios_184", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_154_osx_1231", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-safari_184_osx_154", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_7u25", + "severity" : "INFO", + "finding" : "No connection" + },{ + "id" : "clientsimulation-java_80442", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_1102", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-java_1703", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-java_2106", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-go_1178", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + },{ + "id" : "clientsimulation-libressl_336", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256" + },{ + "id" : "clientsimulation-openssl_102e", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-openssl_111d", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_315", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-openssl_350", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384" + },{ + "id" : "clientsimulation-apple_mail_16_0", + "severity" : "INFO", + "finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384" + },{ + "id" : "clientsimulation-thunderbird_91_9", + "severity" : "INFO", + "finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256" + } + ], + "rating" : [ + { + "id" : "rating_spec", + "severity" : "INFO", + "finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)" + },{ + "id" : "rating_doc", + "severity" : "INFO", + "finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" + },{ + "id" : "protocol_support_score", + "severity" : "INFO", + "finding" : "100" + },{ + "id" : "protocol_support_score_weighted", + "severity" : "INFO", + "finding" : "30" + },{ + "id" : "key_exchange_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "key_exchange_score_weighted", + "severity" : "INFO", + "finding" : "27" + },{ + "id" : "cipher_strength_score", + "severity" : "INFO", + "finding" : "90" + },{ + "id" : "cipher_strength_score_weighted", + "severity" : "INFO", + "finding" : "36" + },{ + "id" : "final_score", + "severity" : "INFO", + "finding" : "93" + },{ + "id" : "overall_grade", + "severity" : "OK", + "finding" : "A+" + } + ] + } + ], + "scanTime" : 53 +} diff --git a/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.log b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.log new file mode 100644 index 0000000..23c68a9 --- /dev/null +++ b/test_case_evidence/DES/DES08/shelly_repo/des08_shelly_repo.log @@ -0,0 +1,208 @@ +## Scan started as: "testssl -oA testssl/des08_shelly_repo repo.shelly.cloud:443" +## at kali:/usr/bin/openssl +## version testssl: 3.2.4 from +## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026") + + Start 2026-11-04 09:16:54 -->> 35.241.201.25:443 (repo.shelly.cloud) <<-- + + rDNS (35.241.201.25): -- + Service detected: HTTP + + Testing protocols via sockets except NPN+ALPN  + + SSLv2 not offered (OK) + SSLv3 not offered (OK) + TLS 1 not offered + TLS 1.1 not offered + TLS 1.2 offered (OK) + TLS 1.3 offered (OK): final + NPN/SPDY not offered + ALPN/HTTP2 http/1.1 (offered) + + Testing cipher categories  + + NULL ciphers (no encryption) not offered (OK) + Anonymous NULL Ciphers (no authentication) not offered (OK) + Export ciphers (w/o ADH+NULL) not offered (OK) + LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) + Triple DES Ciphers / IDEA not offered + Obsoleted CBC ciphers (AES, ARIA etc.) not offered + Strong encryption (AEAD ciphers) with no FS not offered + Forward Secrecy strong encryption (AEAD ciphers) offered (OK) + + + Testing server's cipher preferences  + +Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) +----------------------------------------------------------------------------------------------------------------------------- +SSLv2 + - +SSLv3 + - +TLSv1 + - +TLSv1.1 + - +TLSv1.2 (no server order, thus listed by strength) + xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 +TLSv1.3 (no server order, thus listed by strength) + x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 + x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 + x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 + + Has server cipher order? no + (limited sense as client will pick) + + Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4  + + FS is offered (OK)  TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 + ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 + ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 + TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 + DHE-RSA-AES128-GCM-SHA256 + KEMs offered None + Elliptic curves offered: prime256v1 secp384r1 X25519 + DH group offered: ffdhe2048 + TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224 + TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 + + Testing server defaults (Server Hello)  + + TLS extensions (standard) "server name/#0" "max fragment length/#1" "status request/#5" + "EC point formats/#11" "application layer protocol negotiation/#16" + "extended master secret/#23" "supported versions/#43" + "key share/#51" "renegotiation info/#65281" + Session Ticket RFC 5077 hint no -- no lifetime advertised + SSL Session ID support yes + Session Resumption Tickets no, ID: yes + TLS clock skew Random values, no fingerprinting possible + Certificate Compression none + Client Authentication none + Signature Algorithm SHA256 with RSA + Server key size RSA 2048 bits (exponent is 65537) + Server key usage Digital Signature, Key Encipherment + Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication + Serial 393425BF88EBDD03492962D4E9723D5E (OK: length 16) + Fingerprints SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7 + SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Common Name (CN) *.shelly.cloud  + subjectAltName (SAN) *.shelly.cloud shelly.cloud  + Trust (hostname) Ok via SAN wildcard and CN wildcard (same w/o SNI) + wildcard certificate could be problematic, see other hosts at + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + Chain of trust Ok  + EV cert (experimental) no + Certificate Validity (UTC) 63 >= 60 days (2025-12-07 00:00 --> 2027-01-06 23:59) + ETS/"eTLS", visibility info not present + Certificate Revocation List -- + OCSP URI http://ocsp.sectigo.com + OCSP stapling offered, not revoked + OCSP must staple extension -- + DNS CAA RR (experimental) not offered + Certificate Transparency yes (certificate extension) + Certificates provided 4 + Issuer Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB) + Intermediate cert validity #1: ok > 40 days (2036-03-21 23:59). Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46 + #2: ok > 40 days (2038-01-18 23:59). Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority + #3: ok > 40 days (2038-01-18 23:59). USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority + Intermediate Bad OCSP (exp.) Ok + + + Testing HTTP header response @ "/"  + + HTTP Status Code  401 Unauthorized + HTTP clock skew 0 sec from localtime + Strict Transport Security not offered + Public Key Pinning -- + Server banner nginx/1(B.2(B4(B.0(B (Ubuntu(B) + Application banner -- + Cookie(s) (none issued at "/") -- HTTP status 401 signals you maybe missed the web application + Security headers Access-Control-Allow-Origin: * + Reverse Proxy banner -- + + + Testing vulnerabilities  + + Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension + CCS (CVE-2014-0224) not vulnerable (OK) + Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), no session ticket extension + ROBOT Server does not support any cipher suites that use RSA key transport + Secure Renegotiation (RFC 5746) supported (OK) + Secure Client-Initiated Renegotiation not vulnerable (OK) + CRIME, TLS (CVE-2012-4929) not vulnerable (OK) + BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested + POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support + TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered + SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) + FREAK (CVE-2015-0204) not vulnerable (OK) + DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) + make sure you don't use this certificate elsewhere with SSLv2 enabled services, see + https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867 + LOGJAM (CVE-2015-4000), experimental common prime with 2048 bits detected: RFC7919/ffdhe2048 (2048 bits), + but no DH EXPORT ciphers + BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 + LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) + Winshock (CVE-2014-6321), experimental not vulnerable (OK) + RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) + + + Running client simulations (HTTP) via sockets  + + Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy +------------------------------------------------------------------------------------------------ + Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) + Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 253 bit ECDH (X25519) + Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + IE 8 Win 7 No connection + IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH (ffdhe2048) + IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH (ffdhe2048) + IE 11 Win Phone 8.1 No connection + IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) + Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + Java 7u25 No connection + Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 256 bit ECDH (P-256) + Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 253 bit ECDH (X25519) + OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) + Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) + Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 253 bit ECDH (X25519) + + + Rating (experimental)  + + Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16) + Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide + Protocol Support (weighted) 100 (30) + Key Exchange  (weighted) 90 (27) + Cipher Strength  (weighted) 90 (36) + Final Score 93 + Overall Grade A+ + + Done 2026-11-04 09:17:46 [ 53s] -->> 35.241.201.25:443 (repo.shelly.cloud) <<-- + + diff --git a/network/nmap/des_09_bridge.nmap b/test_case_evidence/DES/DES09/des_09_bridge.nmap similarity index 100% rename from network/nmap/des_09_bridge.nmap rename to test_case_evidence/DES/DES09/des_09_bridge.nmap