add: DES-08
This commit is contained in:
@@ -0,0 +1,159 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","mqtt.production.loqed.com/34.155.200.196","8883","DEBUG","Couldn't determine service, skipping all HTTP checks","",""
|
||||
"pre_128cipher","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","",""
|
||||
"SSLv3","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","",""
|
||||
"TLS1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"TLS1_1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"TLS1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"TLS1_3","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered with final","",""
|
||||
"NPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"ALPN_HTTP2","mqtt.production.loqed.com/34.155.200.196","8883","OK","h2","",""
|
||||
"ALPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","mqtt.production.loqed.com/34.155.200.196","8883","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"cipher_order-tls1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||
"cipher-tls1_2_xc02f","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc013","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc014","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9c","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9d","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x2f","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x35","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","true","",""
|
||||
"cipher_order-tls1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_3_x1302","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipher_order","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- TLS 1.3 client determined","",""
|
||||
"FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||
"FS_ciphers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||
"FS_KEMs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","mqtt.production.loqed.com/34.155.200.196","8883","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||
"FS_TLS12_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||
"FS_TLS13_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||
"TLS_extensions","mqtt.production.loqed.com/34.155.200.196","8883","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","mqtt.production.loqed.com/34.155.200.196","8883","LOW","valid for 604800 seconds (>daily)","",""
|
||||
"SSL_sessionID_support","mqtt.production.loqed.com/34.155.200.196","8883","INFO","yes","",""
|
||||
"sessionresumption_ticket","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","",""
|
||||
"sessionresumption_ID","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","",""
|
||||
"TLS_timestamp","mqtt.production.loqed.com/34.155.200.196","8883","INFO","random","",""
|
||||
"certificate_compression","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","",""
|
||||
"clientAuth","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","",""
|
||||
"cert_numbers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","1","",""
|
||||
"cert_signatureAlgorithm","mqtt.production.loqed.com/34.155.200.196","8883","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","mqtt.production.loqed.com/34.155.200.196","8883","INFO","06E81D5B9CC230FE76507D0EA12EE2BF2BE6","",""
|
||||
"cert_serialNumberLen","mqtt.production.loqed.com/34.155.200.196","8883","INFO","18","",""
|
||||
"cert_fingerprintSHA1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","A5D4BB82B189F9E7924595FFCF31411019B6087F","",""
|
||||
"cert_fingerprintSHA256","mqtt.production.loqed.com/34.155.200.196","8883","INFO","AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","",""
|
||||
"cert","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","mqtt.production.loqed.com/34.155.200.196","8883","OK","mqtt.production.loqed.com","",""
|
||||
"cert_commonName_wo_SNI","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TRAEFIK DEFAULT CERT","",""
|
||||
"cert_subjectAltName","mqtt.production.loqed.com/34.155.200.196","8883","INFO","mqtt.production.loqed.com","",""
|
||||
"cert_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","Ok via SAN and CN (SNI mandatory)","",""
|
||||
"cert_chain_of_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","",""
|
||||
"cert_expirationStatus","mqtt.production.loqed.com/34.155.200.196","8883","OK","86 >= 30 days","",""
|
||||
"cert_notBefore","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-11-01 01:10","",""
|
||||
"cert_notAfter","mqtt.production.loqed.com/34.155.200.196","8883","OK","2027-01-30 01:10","",""
|
||||
"cert_extlifeSpan","mqtt.production.loqed.com/34.155.200.196","8883","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http://yr1.c.lencr.org/103.crl","",""
|
||||
"cert_ocspURL","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","",""
|
||||
"OCSP_stapling","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","",""
|
||||
"DNS_CAArecord","mqtt.production.loqed.com/34.155.200.196","8883","LOW","--","",""
|
||||
"certificate_transparency","mqtt.production.loqed.com/34.155.200.196","8883","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","mqtt.production.loqed.com/34.155.200.196","8883","INFO","3","",""
|
||||
"certs_list_ordering_problem","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","",""
|
||||
"cert_caIssuers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","",""
|
||||
"intermediate_cert_notBefore <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 <-- Root YR","",""
|
||||
"intermediate_cert <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||
"intermediate_cert_notBefore <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Root YR <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","mqtt.production.loqed.com/34.155.200.196","8883","OK","intermediate certificate(s) is/are ok","",""
|
||||
"heartbleed","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","supported","","CWE-310"
|
||||
"secure_client_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310"
|
||||
"POODLE_SSL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","mqtt.production.loqed.com/34.155.200.196","8883","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","mqtt.production.loqed.com/34.155.200.196","8883","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","mqtt.production.loqed.com/34.155.200.196","8883","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_X","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_11_12","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_13_14","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-android_15","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-ie_8_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_winphone81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-ie_11_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_154_osx_1231","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-safari_184_osx_154","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_7u25","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1102","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_1703","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-java_2106","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-go_1178","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-libressl_336","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"clientsimulation-openssl_102e","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_315","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-openssl_350","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"clientsimulation-apple_mail_16_0","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||
"rating_spec","mqtt.production.loqed.com/34.155.200.196","8883","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","mqtt.production.loqed.com/34.155.200.196","8883","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","100","",""
|
||||
"protocol_support_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","30","",""
|
||||
"key_exchange_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","",""
|
||||
"key_exchange_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","27","",""
|
||||
"cipher_strength_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","",""
|
||||
"cipher_strength_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","36","",""
|
||||
"final_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","93","",""
|
||||
"overall_grade","mqtt.production.loqed.com/34.155.200.196","8883","OK","A+","",""
|
||||
|
@@ -0,0 +1,212 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--</span>
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
|
||||
SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>mqtt.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>mqtt.production.loqed.com </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (SNI mandatory)
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr1.c.lencr.org/103.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YR1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR1</i> <-- <i>Root YR</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span> (not using HTTP anyway)
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
Could not determine the protocol, only simulating generic clients.
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,722 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793776604",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "mqtt.production.loqed.com",
|
||||
"ip" : "34.155.200.196",
|
||||
"port" : "8883",
|
||||
"rDNS" : "--",
|
||||
"service" : "Couldn't determine service, skipping all HTTP checks",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN_HTTP2",
|
||||
"severity" : "OK",
|
||||
"finding" : "h2"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "true"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server -- TLS 1.3 client determined"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "LOW",
|
||||
"finding" : "valid for 604800 seconds (>daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "06E81D5B9CC230FE76507D0EA12EE2BF2BE6"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "A5D4BB82B189F9E7924595FFCF31411019B6087F"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "mqtt.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TRAEFIK DEFAULT CERT"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "mqtt.production.loqed.com"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (SNI mandatory)"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "86 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-11-01 01:10"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-30 01:10"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://yr1.c.lencr.org/103.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "3"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR1 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YR1 <-- Root YR"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YR <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not applicable, not HTTP"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable (not using HTTP anyway)"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 64
|
||||
}
|
||||
@@ -0,0 +1,191 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--[m
|
||||
|
||||
rDNS (34.155.200.196): --
|
||||
Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
|
||||
SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||
[1m Common Name (CN) [m[3mmqtt.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||
[1m subjectAltName (SAN) [m[3mmqtt.production.loqed.com [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (SNI mandatory)
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://yr1.c.lencr.org/103.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 3
|
||||
[1m Issuer [m[3mYR1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR1[m <-- [3mRoot YR[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m (not using HTTP anyway)
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
Could not determine the protocol, only simulating generic clients.
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--[m
|
||||
|
||||
|
||||
Reference in New Issue
Block a user