add: DES-08
This commit is contained in:
@@ -0,0 +1,174 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","HTTP","",""
|
||||
"pre_128cipher","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","",""
|
||||
"SSLv3","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","",""
|
||||
"TLS1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"TLS1_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"TLS1_2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||
"TLS1_3","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered + downgraded to weaker protocol","",""
|
||||
"NPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"ALPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"cipherlist_STRONG_FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a cipher order configured","",""
|
||||
"cipher-tls1_2_xc02c","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca9","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc02b","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"supportedciphers_TLSv1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"cipher_order","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a server cipher order configured","",""
|
||||
"FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||
"FS_ciphers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"FS_KEMs","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","changelog-backend.shelly.cloud/34.62.47.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"FS_TLS12_sig_algs","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224","",""
|
||||
"TLS_extensions","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no -- no lifetime advertised","",""
|
||||
"SSL_sessionID_support","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","",""
|
||||
"sessionresumption_ID","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","",""
|
||||
"TLS_timestamp","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","random","",""
|
||||
"cert_compression","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","N/A","",""
|
||||
"clientAuth","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","none","",""
|
||||
"cert_numbers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ECDSA with SHA384","",""
|
||||
"cert_keySize","changelog-backend.shelly.cloud/34.62.47.252","443","OK","EC 256 bits (curve P-256)","",""
|
||||
"cert_keyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Digital Signature","",""
|
||||
"cert_extKeyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS Web Server Authentication","",""
|
||||
"cert_serialNumber","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0582918DB89B4A8A742D84FD104CDC41D76B","",""
|
||||
"cert_serialNumberLen","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","18","",""
|
||||
"cert_fingerprintSHA1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2B1B2A1E33BDD140FA382D85F749503A2CEB16FD","",""
|
||||
"cert_fingerprintSHA256","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF","",""
|
||||
"cert","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","changelog-backend.shelly.cloud/34.62.47.252","443","OK","changelog-backend.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","changelog-backend.shelly.cloud","",""
|
||||
"cert_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","Ok via SAN and CN (works w/o SNI)","",""
|
||||
"cert_trust_wildcard","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","",""
|
||||
"cert_expirationStatus","changelog-backend.shelly.cloud/34.62.47.252","443","OK","46 >= 30 days","",""
|
||||
"cert_notBefore","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-09-21 09:03","",""
|
||||
"cert_notAfter","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2026-12-20 09:03","",""
|
||||
"cert_extlifeSpan","changelog-backend.shelly.cloud/34.62.47.252","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http://ye1.c.lencr.org/108.crl","",""
|
||||
"cert_ocspURL","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","",""
|
||||
"OCSP_stapling","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||
"cert_mustStapleExtension","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","",""
|
||||
"DNS_CAArecord","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","--","",""
|
||||
"certificate_transparency","changelog-backend.shelly.cloud/34.62.47.252","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","4","",""
|
||||
"certs_list_ordering_problem","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","",""
|
||||
"cert_caIssuers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 (Let's Encrypt from US)","",""
|
||||
"intermediate_cert <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07","",""
|
||||
"intermediate_cert_notBefore <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2025-09-03 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2028-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 <-- Root YE","",""
|
||||
"intermediate_cert <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0","",""
|
||||
"intermediate_cert_notBefore <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Root YE <-- ISRG Root X2","",""
|
||||
"intermediate_cert <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6","",""
|
||||
"intermediate_cert_notBefore <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ISRG Root X2 <-- ISRG Root X1","",""
|
||||
"intermediate_cert_badOCSP","changelog-backend.shelly.cloud/34.62.47.252","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","404 Not Found ('/')","",""
|
||||
"HTTP_clock_skew","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1793780149","",""
|
||||
"HSTS_time","changelog-backend.shelly.cloud/34.62.47.252","443","OK","180 days (=15552000 seconds) > 15552000 seconds","",""
|
||||
"HSTS_subdomains","changelog-backend.shelly.cloud/34.62.47.252","443","OK","includes subdomains","",""
|
||||
"HSTS_preload","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","domain is NOT marked for preloading","",""
|
||||
"HPKP","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||
"banner_application","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No application banner found","",""
|
||||
"cookie_count","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"X-Frame-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","SAMEORIGIN","",""
|
||||
"X-Content-Type-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","nosniff","",""
|
||||
"Content-Security-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","OK","default-src 'none'","",""
|
||||
"Cross-Origin-Opener-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","",""
|
||||
"Cross-Origin-Resource-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","",""
|
||||
"Cross-Origin-Embedder-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","require-corp","",""
|
||||
"X-XSS-Protection","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0","",""
|
||||
"Access-Control-Allow-Origin","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*","",""
|
||||
"Referrer-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no-referrer","",""
|
||||
"banner_reverseproxy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","","CWE-200"
|
||||
"heartbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","changelog-backend.shelly.cloud/34.62.47.252","443","MEDIUM","potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no RSA certificate, can't be used with SSLv2 elsewhere","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||
"winshock","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_X","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_11_12","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_13_14","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_15","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-chrome_101_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-chromium_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-firefox_100_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-firefox_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-ie_8_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_101_win10_21h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_133_win11_23h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-safari_184_ios_184","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_7u25","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1102","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1703","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_2106","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-go_1178","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-libressl_336","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305","",""
|
||||
"clientsimulation-openssl_102e","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_315","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_350","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-thunderbird_91_9","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||
"rating_spec","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","",""
|
||||
"key_exchange_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","",""
|
||||
"key_exchange_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","",""
|
||||
"cipher_strength_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","36","",""
|
||||
"final_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","96","",""
|
||||
"overall_grade","changelog-backend.shelly.cloud/34.62.47.252","443","OK","A-","",""
|
||||
"grade_cap_warning_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS 1.3 is not supported","",""
|
||||
|
@@ -0,0 +1,224 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (34.62.47.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span>not offered and downgraded to a weaker protocol
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
<u>TLSv1.3</u>
|
||||
-
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||
<span style="color:#cd00cd;"> -- inconclusive test, matching cipher in list missing</span>, better see above
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||
ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">ECDSA with SHA384</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>EC <span style="color:#008817;">256</span> bits (curve P-256)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
|
||||
SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>changelog-backend.shelly.cloud </i> (CN in response to request w/o SNI: <i>*.shelly.cloud </i>)
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>changelog-backend.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (works w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">46 >= 30 days</span> (2026-09-21 09:03 --> 2026-12-20 09:03)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>http://ye1.c.lencr.org/108.crl
|
||||
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>YE1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YE1</i> <-- <i>Root YE</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YE</i> <-- <i>ISRG Root X2</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>ISRG Root X2</i> <-- <i>ISRG Root X1</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#008817;">180 days</span>=15552000 s<span style="color:#008817;">, includeSubDomains</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span><span style="color:#008817;">X-Frame-Options</span>: SAMEORIGIN
|
||||
<span style="color:#008817;">X-Content-Type-Options</span>: nosniff
|
||||
<span style="color:#008817;">Content-Security-Policy</span>: default-src 'none'
|
||||
Cross-Origin-Opener-Policy: same-origin
|
||||
Cross-Origin-Resource-Policy: same-origin
|
||||
Cross-Origin-Embedder-Policy: require-corp
|
||||
X-XSS-Protection: 0
|
||||
Access-Control-Allow-Origin: *
|
||||
Referrer-Policy: no-referrer
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#c05600;">potentially NOT ok, "gzip" HTTP compression detected.</span> - only supplied "/" tested
|
||||
Can be ignored for static pages or if no secrets in the page
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span> - ARIA, CHACHA or CCM ciphers found
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>96
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A-</span>
|
||||
<span style="font-weight:bold;"> Grade warning </span><span style="color:#c05600;">TLS 1.3 is not supported</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,785 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793780130",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "changelog-backend.shelly.cloud",
|
||||
"ip" : "34.62.47.252",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered + downgraded to weaker protocol"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a cipher order configured"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca9",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02b",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "supportedciphers_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "INFO",
|
||||
"finding" : "NOT a server cipher order configured"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no -- no lifetime advertised"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "cert_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "N/A"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "ECDSA with SHA384"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "OK",
|
||||
"finding" : "EC 256 bits (curve P-256)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0582918DB89B4A8A742D84FD104CDC41D76B"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "18"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2B1B2A1E33BDD140FA382D85F749503A2CEB16FD"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "changelog-backend.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "changelog-backend.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN and CN (works w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "46 >= 30 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-09-21 09:03"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2026-12-20 09:03"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ye1.c.lencr.org/108.crl"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YE1 (Let's Encrypt from US)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-09-03 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2028-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "YE1 <-- Root YE"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Root YE <-- ISRG Root X2"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2026-05-13 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2032-09-02 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ISRG Root X2 <-- ISRG Root X1"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "404 Not Found ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793780149"
|
||||
},{
|
||||
"id" : "HSTS_time",
|
||||
"severity" : "OK",
|
||||
"finding" : "180 days (=15552000 seconds) > 15552000 seconds"
|
||||
},{
|
||||
"id" : "HSTS_subdomains",
|
||||
"severity" : "OK",
|
||||
"finding" : "includes subdomains"
|
||||
},{
|
||||
"id" : "HSTS_preload",
|
||||
"severity" : "INFO",
|
||||
"finding" : "domain is NOT marked for preloading"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "X-Frame-Options",
|
||||
"severity" : "OK",
|
||||
"finding" : "SAMEORIGIN"
|
||||
},{
|
||||
"id" : "X-Content-Type-Options",
|
||||
"severity" : "OK",
|
||||
"finding" : "nosniff"
|
||||
},{
|
||||
"id" : "Content-Security-Policy",
|
||||
"severity" : "OK",
|
||||
"finding" : "default-src 'none'"
|
||||
},{
|
||||
"id" : "Cross-Origin-Opener-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "same-origin"
|
||||
},{
|
||||
"id" : "Cross-Origin-Resource-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "same-origin"
|
||||
},{
|
||||
"id" : "Cross-Origin-Embedder-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "require-corp"
|
||||
},{
|
||||
"id" : "X-XSS-Protection",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "Referrer-Policy",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no-referrer"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "no session ticket extension"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "MEDIUM",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no RSA certificate, can't be used with SSLv2 elsewhere"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "96"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A-"
|
||||
},{
|
||||
"id" : "grade_cap_warning_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS 1.3 is not supported"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 46
|
||||
}
|
||||
@@ -0,0 +1,203 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (34.62.47.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [mnot offered and downgraded to a weaker protocol
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
[4mTLSv1.3[m
|
||||
-
|
||||
|
||||
[1m Has server cipher order? [mno
|
||||
[0;35m -- inconclusive test, matching cipher in list missing[m, better see above
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||
ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m TLS 1.2 sig_algs offered: [mECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16"
|
||||
"extended master secret/#23" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets no, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mECDSA with SHA384[m
|
||||
[1m Server key size [mEC [0;32m256[m bits (curve P-256)
|
||||
[1m Server key usage [mDigital Signature
|
||||
[1m Server extended key usage [mTLS Web Server Authentication
|
||||
[1m Serial [m0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
|
||||
[1m Fingerprints [mSHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
|
||||
SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
[1m Common Name (CN) [m[3mchangelog-backend.shelly.cloud [m (CN in response to request w/o SNI: [3m*.shelly.cloud [m)
|
||||
[1m subjectAltName (SAN) [m[3mchangelog-backend.shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (works w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m46 >= 30 days[m (2026-09-21 09:03 --> 2026-12-20 09:03)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [mhttp://ye1.c.lencr.org/108.crl
|
||||
[1m OCSP URI [m--
|
||||
[1m OCSP stapling [mnot offered
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mYE1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYE1[m <-- [3mRoot YE[m
|
||||
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YE[m <-- [3mISRG Root X2[m
|
||||
#3: [0;32mok > 40 days[m (2032-09-02 23:59). [3mISRG Root X2[m <-- [3mISRG Root X1[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[0;32m180 days[m=15552000 s[0;32m, includeSubDomains[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
[1m Security headers [m[0;32mX-Frame-Options[m: SAMEORIGIN
|
||||
[0;32mX-Content-Type-Options[m: nosniff
|
||||
[0;32mContent-Security-Policy[m: default-src 'none'
|
||||
Cross-Origin-Opener-Policy: same-origin
|
||||
Cross-Origin-Resource-Policy: same-origin
|
||||
Cross-Origin-Embedder-Policy: require-corp
|
||||
X-XSS-Protection: 0
|
||||
Access-Control-Allow-Origin: *
|
||||
Referrer-Policy: no-referrer
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;33mpotentially NOT ok, "gzip" HTTP compression detected.[m - only supplied "/" tested
|
||||
Can be ignored for static pages or if no secrets in the page
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m - ARIA, CHACHA or CCM ciphers found
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 100 (30)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m96
|
||||
[1m Overall Grade [m[1;32mA-[m
|
||||
[1m Grade warning [m[0;33mTLS 1.3 is not supported[m
|
||||
|
||||
[7m Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
Reference in New Issue
Block a user