add: DES-08
This commit is contained in:
@@ -0,0 +1,172 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","api.production.loqed.com/34.155.200.196","443","INFO","HTTP","",""
|
||||
"pre_128cipher","api.production.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","api.production.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||
"SSLv3","api.production.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||
"TLS1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"TLS1_1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"TLS1_2","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"TLS1_3","api.production.loqed.com/34.155.200.196","443","OK","offered with final","",""
|
||||
"NPN","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"ALPN_HTTP2","api.production.loqed.com/34.155.200.196","443","OK","h2","",""
|
||||
"ALPN","api.production.loqed.com/34.155.200.196","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","api.production.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","api.production.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||
"cipher-tls1_2_xc02f","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc013","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc014","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9c","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9d","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x2f","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x35","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","true","",""
|
||||
"cipher_order-tls1_3","api.production.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","api.production.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","",""
|
||||
"FS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||
"FS_ciphers","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||
"FS_KEMs","api.production.loqed.com/34.155.200.196","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","api.production.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||
"FS_TLS12_sig_algs","api.production.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||
"FS_TLS13_sig_algs","api.production.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","api.production.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","api.production.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","",""
|
||||
"SSL_sessionID_support","api.production.loqed.com/34.155.200.196","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","api.production.loqed.com/34.155.200.196","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","api.production.loqed.com/34.155.200.196","443","INFO","supported","",""
|
||||
"TLS_timestamp","api.production.loqed.com/34.155.200.196","443","INFO","random","",""
|
||||
"certificate_compression","api.production.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||
"clientAuth","api.production.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||
"cert_numbers","api.production.loqed.com/34.155.200.196","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","api.production.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","api.production.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","api.production.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","api.production.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","api.production.loqed.com/34.155.200.196","443","INFO","056B01F8C0078A7719EB49BF14357173112F","",""
|
||||
"cert_serialNumberLen","api.production.loqed.com/34.155.200.196","443","INFO","18","",""
|
||||
"cert_fingerprintSHA1","api.production.loqed.com/34.155.200.196","443","INFO","6A4E93FA165A64A590BF098743A6D7DD99911DEE","",""
|
||||
"cert_fingerprintSHA256","api.production.loqed.com/34.155.200.196","443","INFO","11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","",""
|
||||
"cert","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","api.production.loqed.com/34.155.200.196","443","OK","api.production.loqed.com","",""
|
||||
"cert_commonName_wo_SNI","api.production.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","",""
|
||||
"cert_subjectAltName","api.production.loqed.com/34.155.200.196","443","INFO","api.production.loqed.com","",""
|
||||
"cert_trust","api.production.loqed.com/34.155.200.196","443","OK","Ok via SAN and CN (SNI mandatory)","",""
|
||||
"cert_chain_of_trust","api.production.loqed.com/34.155.200.196","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","api.production.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||
"cert_expirationStatus","api.production.loqed.com/34.155.200.196","443","OK","86 >= 30 days","",""
|
||||
"cert_notBefore","api.production.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:16","",""
|
||||
"cert_notAfter","api.production.loqed.com/34.155.200.196","443","OK","2027-01-30 01:16","",""
|
||||
"cert_extlifeSpan","api.production.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","api.production.loqed.com/34.155.200.196","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","api.production.loqed.com/34.155.200.196","443","INFO","http://yr2.c.lencr.org/48.crl","",""
|
||||
"cert_ocspURL","api.production.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||
"OCSP_stapling","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","api.production.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||
"DNS_CAArecord","api.production.loqed.com/34.155.200.196","443","LOW","--","",""
|
||||
"certificate_transparency","api.production.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","api.production.loqed.com/34.155.200.196","443","INFO","3","",""
|
||||
"certs_list_ordering_problem","api.production.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||
"cert_caIssuers","api.production.loqed.com/34.155.200.196","443","INFO","YR2 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","api.production.loqed.com/34.155.200.196","443","INFO","238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47","",""
|
||||
"intermediate_cert_notBefore <#1>","api.production.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","api.production.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","api.production.loqed.com/34.155.200.196","443","INFO","YR2 <-- Root YR","",""
|
||||
"intermediate_cert <#2>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","api.production.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||
"intermediate_cert_notBefore <#2>","api.production.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","api.production.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","api.production.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","api.production.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","api.production.loqed.com/34.155.200.196","443","WARN","Unexpected 415 Unsupported Media Type @ '/'","",""
|
||||
"HTTP_clock_skew","api.production.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","api.production.loqed.com/34.155.200.196","443","INFO","1793777783","",""
|
||||
"HSTS","api.production.loqed.com/34.155.200.196","443","LOW","not offered","",""
|
||||
"HPKP","api.production.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","api.production.loqed.com/34.155.200.196","443","INFO","No Server banner line in header, interesting!","",""
|
||||
"banner_application","api.production.loqed.com/34.155.200.196","443","INFO","No application banner found","",""
|
||||
"cookie_count","api.production.loqed.com/34.155.200.196","443","INFO","1 at '/' (maybe missed the application)","",""
|
||||
"cookie_secure","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as secure","",""
|
||||
"cookie_httponly","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as HttpOnly (maybe missed the application)","",""
|
||||
"security_headers","api.production.loqed.com/34.155.200.196","443","MEDIUM","--","",""
|
||||
"banner_reverseproxy","api.production.loqed.com/34.155.200.196","443","INFO","--","","CWE-200"
|
||||
"heartbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","api.production.loqed.com/34.155.200.196","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","api.production.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","api.production.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","api.production.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","api.production.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","api.production.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_winphone81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","api.production.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1102","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_2106","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-go_1178","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_315","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_350","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-apple_mail_16_0","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","api.production.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","api.production.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","api.production.loqed.com/34.155.200.196","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","30","",""
|
||||
"key_exchange_score","api.production.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","27","",""
|
||||
"cipher_strength_score","api.production.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","36","",""
|
||||
"final_score","api.production.loqed.com/34.155.200.196","443","INFO","93","",""
|
||||
"overall_grade","api.production.loqed.com/34.155.200.196","443","OK","A+","",""
|
||||
|
@@ -0,0 +1,225 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<--</span>
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
|
||||
SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>api.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>api.production.loqed.com </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (SNI mandatory)
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:16 --> 2027-01-30 01:16)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr2.c.lencr.org/48.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YR2</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR2</i> <-- <i>Root YR</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 415 Unsupported Media Type<span style="color:#cd00cd;">. Oh, didn't expect "415 Unsupported Media Type"</span>
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>1 issued: <span style="color:#008817;">1/1</span> secure, <span style="color:#008817;">1/1</span> HttpOnly -- HTTP status 415 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span><span style="color:#c05600;">--</span>
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,777 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793777755",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "api.production.loqed.com",
|
||||
"ip" : "34.155.200.196",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN_HTTP2",
|
||||
"severity" : "OK",
|
||||
"finding" : "h2"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "true"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- TLS 1.3 client determined"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "LOW",
|
||||
"finding" : "valid for 604800 seconds (>daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "056B01F8C0078A7719EB49BF14357173112F"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "6A4E93FA165A64A590BF098743A6D7DD99911DEE"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "api.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TRAEFIK DEFAULT CERT"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "api.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (SNI mandatory)"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "86 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-11-01 01:16"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-30 01:16"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://yr2.c.lencr.org/48.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR2 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR2 <-- Root YR"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YR <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "WARN",
|
||||
"finding" : "Unexpected 415 Unsupported Media Type @ '/'"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793777783"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No Server banner line in header, interesting!"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "cookie_secure",
|
||||
"severity" : "OK",
|
||||
"finding" : "All (1) at '/' marked as secure"
|
||||
},{
|
||||
"id" : "cookie_httponly",
|
||||
"severity" : "OK",
|
||||
"finding" : "All (1) at '/' marked as HttpOnly (maybe missed the application)"
|
||||
},{
|
||||
"id" : "security_headers",
|
||||
"severity" : "MEDIUM",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 67
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<--[m
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: yes
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
|
||||
SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||
[1m Common Name (CN) [m[3mapi.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||
[1m subjectAltName (SAN) [m[3mapi.production.loqed.com [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (SNI mandatory)
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:16 --> 2027-01-30 01:16)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://yr2.c.lencr.org/48.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 3
|
||||
[1m Issuer [m[3mYR2[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR2[m <-- [3mRoot YR[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 415 Unsupported Media Type[0;35m. Oh, didn't expect "415 Unsupported Media Type"[m
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m1 issued: [0;32m1/1[m secure, [0;32m1/1[m HttpOnly -- HTTP status 415 signals you maybe missed the web application
|
||||
[1m Security headers [m[0;33m--[m
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--[m
|
||||
|
||||
|
||||
Reference in New Issue
Block a user