add: DES-08
This commit is contained in:
@@ -0,0 +1,189 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","HTTP","",""
|
||||
"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","",""
|
||||
"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","",""
|
||||
"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||
"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||
"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered + downgraded to weaker protocol","",""
|
||||
"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||
"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","",""
|
||||
"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xc077","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc076","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc0a1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8","",""
|
||||
"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||
"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc0a0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8","",""
|
||||
"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||
"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xba","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x84","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x41","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","false","",""
|
||||
"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","",""
|
||||
"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||
"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","No KEMs offered","",""
|
||||
"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||
"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","valid for 300 seconds only (<daily)","",""
|
||||
"SSL_sessionID_support","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","supported","",""
|
||||
"sessionresumption_ID","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not supported","",""
|
||||
"TLS_timestamp","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","random","",""
|
||||
"cert_compression","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","N/A","",""
|
||||
"clientAuth","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","none","",""
|
||||
"cert_numbers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","",""
|
||||
"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","",""
|
||||
"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","--","",""
|
||||
"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","",""
|
||||
"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","WARN","Unexpected 500 Internal Server Error @ '/'","",""
|
||||
"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1793779728","",""
|
||||
"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","",""
|
||||
"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||
"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No application banner found","",""
|
||||
"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*","",""
|
||||
"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","","CWE-200"
|
||||
"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","30","",""
|
||||
"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","27","",""
|
||||
"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","36","",""
|
||||
"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","93","",""
|
||||
"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","A-","",""
|
||||
"grade_cap_warning_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS 1.3 is not supported","",""
|
||||
|
@@ -0,0 +1,246 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span>not offered and downgraded to a weaker protocol
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH<span style="color:#008817;"> 253</span> Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH<span style="color:#008817;"> 253</span> Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
<u>TLSv1.3</u>
|
||||
-
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
|
||||
ECDHE-ARIA128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>300 seconds, session tickets keys seems to be rotated < daily
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 500 Internal Server Error<span style="color:#cd00cd;">. Oh, didn't expect "500 Internal Server Error"</span>
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||
<span style="font-weight:bold;"> Application banner </span>--
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 500 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span> - ARIA, CHACHA or CCM ciphers found
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A-</span>
|
||||
<span style="font-weight:bold;"> Grade warning </span><span style="color:#c05600;">TLS 1.3 is not supported</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,845 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793779704",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-infra1-eu.shelly.cloud",
|
||||
"ip" : "35.205.173.252",
|
||||
"port" : "443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered + downgraded to weaker protocol"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc061",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc060",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc028",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc077",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc027",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc076",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc0a1",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc051",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc0a0",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc050",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3d",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc0",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3c",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xba",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x84",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x41",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "LOW",
|
||||
"finding" : "No KEMs offered"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "valid for 300 seconds only (<daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "cert_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "N/A"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "WARN",
|
||||
"finding" : "Unexpected 500 Internal Server Error @ '/'"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793779728"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No application banner found"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A-"
|
||||
},{
|
||||
"id" : "grade_cap_warning_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS 1.3 is not supported"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 64
|
||||
}
|
||||
@@ -0,0 +1,225 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [mnot offered and downgraded to a weaker protocol
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order)
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH[0;32m 253[m Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH[0;32m 253[m Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
[4mTLSv1.3[m
|
||||
-
|
||||
|
||||
[1m Has server cipher order? [m[1;32myes (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
|
||||
ECDHE-ARIA128-GCM-SHA256
|
||||
[1m KEMs offered [m[1;33mNone[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m300 seconds, session tickets keys seems to be rotated < daily
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[1;33mnot offered[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 500 Internal Server Error[0;35m. Oh, didn't expect "500 Internal Server Error"[m
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||
[1m Application banner [m--
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 500 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m - ARIA, CHACHA or CCM ciphers found
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA-[m
|
||||
[1m Grade warning [m[0;33mTLS 1.3 is not supported[m
|
||||
|
||||
[7m Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
@@ -0,0 +1,188 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","HTTP","",""
|
||||
"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","",""
|
||||
"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","",""
|
||||
"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||
"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||
"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered with final","",""
|
||||
"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||
"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","offered","","CWE-310"
|
||||
"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||
"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||
"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||
"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||
"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","",""
|
||||
"cipher_order-tls1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||
"cipher-tls1_3_x1302","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipherorder_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"prioritize_chacha_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","",""
|
||||
"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||
"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||
"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||
"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","X25519MLKEM768","",""
|
||||
"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"DH_groups","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ffdhe2048 ffdhe3072","",""
|
||||
"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||
"FS_TLS13_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||
"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||
"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","valid for 7200 seconds only (<daily)","",""
|
||||
"SSL_sessionID_support","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","yes","",""
|
||||
"sessionresumption_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","supported","",""
|
||||
"sessionresumption_ID","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not supported","",""
|
||||
"TLS_timestamp","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","random","",""
|
||||
"certificate_compression","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","none","",""
|
||||
"clientAuth","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","none","",""
|
||||
"cert_numbers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1","",""
|
||||
"cert_signatureAlgorithm","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","SHA256 with RSA","",""
|
||||
"cert_keySize","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||
"cert_keyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Digital Signature, Key Encipherment","",""
|
||||
"cert_extKeyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||
"cert_serialNumber","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||
"cert_serialNumberLen","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","16","",""
|
||||
"cert_fingerprintSHA1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||
"cert_fingerprintSHA256","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||
"cert","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||
"cert_commonName","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","*.shelly.cloud","",""
|
||||
"cert_commonName_wo_SNI","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*.shelly.cloud","",""
|
||||
"cert_subjectAltName","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||
"cert_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||
"cert_trust_wildcard","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","trust is via wildcard","",""
|
||||
"cert_chain_of_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","passed.","",""
|
||||
"cert_certificatePolicies_EV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","",""
|
||||
"cert_expirationStatus","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","63 >= 60 days","",""
|
||||
"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2025-12-07 00:00","",""
|
||||
"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2027-01-06 23:59","",""
|
||||
"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","certificate has no extended life time according to browser forum","",""
|
||||
"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not present","",""
|
||||
"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","",""
|
||||
"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http://ocsp.sectigo.com","",""
|
||||
"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","",""
|
||||
"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","",""
|
||||
"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","--","",""
|
||||
"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","yes (certificate extension)","",""
|
||||
"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","4","",""
|
||||
"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","",""
|
||||
"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||
"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||
"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2036-03-21 23:59","",""
|
||||
"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||
"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||
"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","",""
|
||||
"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||
"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||
"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2010-02-01 00:00","",""
|
||||
"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","",""
|
||||
"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||
"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||
"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","intermediate certificate(s) is/are ok","",""
|
||||
"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","404 Not Found ('/')","",""
|
||||
"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1793779861","",""
|
||||
"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","",""
|
||||
"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No Server banner line in header, interesting!","",""
|
||||
"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","X-Powered-By: Express","",""
|
||||
"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 at '/' (maybe missed the application)","",""
|
||||
"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*","",""
|
||||
"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","","CWE-200"
|
||||
"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no protocol below TLS 1.2 offered","",""
|
||||
"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||
"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||
"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","",""
|
||||
"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||
"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||
"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","100","",""
|
||||
"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","30","",""
|
||||
"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","",""
|
||||
"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","27","",""
|
||||
"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","",""
|
||||
"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","36","",""
|
||||
"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","93","",""
|
||||
"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","A+","",""
|
||||
|
@@ -0,0 +1,242 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||
<title>testssl.sh</title>
|
||||
</head>
|
||||
<body>
|
||||
<pre>
|
||||
<span style="font-weight:bold;">
|
||||
#####################################################################</span>
|
||||
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||
<span style="font-weight:bold;">
|
||||
This program is free software. Distribution and modification under
|
||||
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||
|
||||
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||
<span style="font-weight:bold;">#####################################################################</span>
|
||||
|
||||
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||
on kali:/usr/bin/openssl
|
||||
|
||||
<span style="color:white;background-color:black;"> Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||
|
||||
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||
|
||||
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
<u>SSLv2</u>
|
||||
-
|
||||
<u>SSLv3</u>
|
||||
-
|
||||
<u>TLSv1</u>
|
||||
-
|
||||
<u>TLSv1.1</u>
|
||||
-
|
||||
<u>TLSv1.2</u> (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
<u>TLSv1.3</u> (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||
|
||||
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||
|
||||
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||
|
||||
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||
<span style="font-weight:bold;"> Application banner </span><span style="color:#8a7237;font-weight:bold;">X-Powered-By</span>: Express'
|
||||
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||
|
||||
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span> -- mitigated (disconnect after 4/10 attempts)
|
||||
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||
|
||||
|
||||
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||
|
||||
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||
<span style="font-weight:bold;"> Final Score </span>93
|
||||
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||
|
||||
<span style="color:white;background-color:black;"> Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||
|
||||
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,841 @@
|
||||
{
|
||||
"Invocation" : "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443",
|
||||
"at" : "kali:/usr/bin/openssl",
|
||||
"version" : "3.2.4 ",
|
||||
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||
"startTime" : "1793779827",
|
||||
"scanResult" : [
|
||||
{
|
||||
"targetHost" : "shelly-infra1-eu.shelly.cloud",
|
||||
"ip" : "35.205.173.252",
|
||||
"port" : "9443",
|
||||
"rDNS" : "--",
|
||||
"service" : "HTTP",
|
||||
"pretest" : [
|
||||
{
|
||||
"id" : "pre_128cipher",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No 128 cipher limit bug"
|
||||
}
|
||||
],
|
||||
"protocols" : [
|
||||
{
|
||||
"id" : "SSLv2",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "SSLv3",
|
||||
"severity" : "OK",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "TLS1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "TLS1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered with final"
|
||||
},{
|
||||
"id" : "NPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "ALPN",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http/1.1"
|
||||
}
|
||||
],
|
||||
"grease" : [
|
||||
|
||||
],
|
||||
"ciphers" : [
|
||||
{
|
||||
"id" : "cipherlist_NULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_aNULL",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_EXPORT",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_LOW",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_3DES_IDEA",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cipherlist_OBSOLETED",
|
||||
"severity" : "LOW",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_NOFS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "cipherlist_STRONG_FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
}
|
||||
],
|
||||
"serverPreferences" : [
|
||||
{
|
||||
"id" : "cipher_order-tls1_2",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc02f",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc030",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc027",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc028",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xcca8",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc061",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc060",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc014",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc013",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09d",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc051",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x9c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc09c",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_xc050",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3d",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x3c",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x35",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipher-tls1_2_x2f",
|
||||
"severity" : "LOW",
|
||||
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order-tls1_3",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1302",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1303",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||
},{
|
||||
"id" : "cipher-tls1_3_x1301",
|
||||
"severity" : "OK",
|
||||
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "cipherorder_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||
},{
|
||||
"id" : "prioritize_chacha_TLSv1_3",
|
||||
"severity" : "INFO",
|
||||
"finding" : "false"
|
||||
},{
|
||||
"id" : "cipher_order",
|
||||
"severity" : "OK",
|
||||
"finding" : "server"
|
||||
}
|
||||
],
|
||||
"fs" : [
|
||||
{
|
||||
"id" : "FS",
|
||||
"severity" : "OK",
|
||||
"finding" : "offered"
|
||||
},{
|
||||
"id" : "FS_ciphers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "FS_KEMs",
|
||||
"severity" : "OK",
|
||||
"finding" : "X25519MLKEM768"
|
||||
},{
|
||||
"id" : "FS_ECDHE_curves",
|
||||
"severity" : "OK",
|
||||
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||
},{
|
||||
"id" : "DH_groups",
|
||||
"severity" : "OK",
|
||||
"finding" : "ffdhe2048 ffdhe3072"
|
||||
},{
|
||||
"id" : "FS_TLS12_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||
},{
|
||||
"id" : "FS_TLS13_sig_algs",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||
}
|
||||
],
|
||||
"serverDefaults" : [
|
||||
{
|
||||
"id" : "TLS_extensions",
|
||||
"severity" : "INFO",
|
||||
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||
},{
|
||||
"id" : "TLS_session_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "valid for 7200 seconds only (<daily)"
|
||||
},{
|
||||
"id" : "SSL_sessionID_support",
|
||||
"severity" : "INFO",
|
||||
"finding" : "yes"
|
||||
},{
|
||||
"id" : "sessionresumption_ticket",
|
||||
"severity" : "INFO",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "sessionresumption_ID",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not supported"
|
||||
},{
|
||||
"id" : "TLS_timestamp",
|
||||
"severity" : "INFO",
|
||||
"finding" : "random"
|
||||
},{
|
||||
"id" : "certificate_compression",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "clientAuth",
|
||||
"severity" : "INFO",
|
||||
"finding" : "none"
|
||||
},{
|
||||
"id" : "cert_numbers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1"
|
||||
},{
|
||||
"id" : "cert_signatureAlgorithm",
|
||||
"severity" : "OK",
|
||||
"finding" : "SHA256 with RSA"
|
||||
},{
|
||||
"id" : "cert_keySize",
|
||||
"severity" : "INFO",
|
||||
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||
},{
|
||||
"id" : "cert_keyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Digital Signature, Key Encipherment"
|
||||
},{
|
||||
"id" : "cert_extKeyUsage",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||
},{
|
||||
"id" : "cert_serialNumber",
|
||||
"severity" : "INFO",
|
||||
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||
},{
|
||||
"id" : "cert_serialNumberLen",
|
||||
"severity" : "INFO",
|
||||
"finding" : "16"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA1",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||
},{
|
||||
"id" : "cert_fingerprintSHA256",
|
||||
"severity" : "INFO",
|
||||
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "cert",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "cert_commonName",
|
||||
"severity" : "OK",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_commonName_wo_SNI",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_subjectAltName",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*.shelly.cloud shelly.cloud"
|
||||
},{
|
||||
"id" : "cert_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||
},{
|
||||
"id" : "cert_trust_wildcard",
|
||||
"severity" : "LOW",
|
||||
"finding" : "trust is via wildcard"
|
||||
},{
|
||||
"id" : "cert_chain_of_trust",
|
||||
"severity" : "OK",
|
||||
"finding" : "passed."
|
||||
},{
|
||||
"id" : "cert_certificatePolicies_EV",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_expirationStatus",
|
||||
"severity" : "OK",
|
||||
"finding" : "63 >= 60 days"
|
||||
},{
|
||||
"id" : "cert_notBefore",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2025-12-07 00:00"
|
||||
},{
|
||||
"id" : "cert_notAfter",
|
||||
"severity" : "OK",
|
||||
"finding" : "2027-01-06 23:59"
|
||||
},{
|
||||
"id" : "cert_extlifeSpan",
|
||||
"severity" : "OK",
|
||||
"finding" : "certificate has no extended life time according to browser forum"
|
||||
},{
|
||||
"id" : "cert_eTLS",
|
||||
"severity" : "INFO",
|
||||
"finding" : "not present"
|
||||
},{
|
||||
"id" : "cert_crlDistributionPoints",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "cert_ocspURL",
|
||||
"severity" : "INFO",
|
||||
"finding" : "http://ocsp.sectigo.com"
|
||||
},{
|
||||
"id" : "OCSP_stapling",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "cert_mustStapleExtension",
|
||||
"severity" : "INFO",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "DNS_CAArecord",
|
||||
"severity" : "LOW",
|
||||
"finding" : "--"
|
||||
},{
|
||||
"id" : "certificate_transparency",
|
||||
"severity" : "OK",
|
||||
"finding" : "yes (certificate extension)"
|
||||
},{
|
||||
"id" : "certs_countServer",
|
||||
"severity" : "INFO",
|
||||
"finding" : "4"
|
||||
},{
|
||||
"id" : "certs_list_ordering_problem",
|
||||
"severity" : "INFO",
|
||||
"finding" : "no"
|
||||
},{
|
||||
"id" : "cert_caIssuers",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||
},{
|
||||
"id" : "intermediate_cert <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2036-03-21 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#1>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#1>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||
},{
|
||||
"id" : "intermediate_cert <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2021-03-22 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#2>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#2>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||
},{
|
||||
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||
},{
|
||||
"id" : "intermediate_cert_notBefore <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "2010-02-01 00:00"
|
||||
},{
|
||||
"id" : "intermediate_cert_notAfter <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "2038-01-18 23:59"
|
||||
},{
|
||||
"id" : "intermediate_cert_expiration <#3>",
|
||||
"severity" : "OK",
|
||||
"finding" : "ok > 40 days"
|
||||
},{
|
||||
"id" : "intermediate_cert_chain <#3>",
|
||||
"severity" : "INFO",
|
||||
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||
},{
|
||||
"id" : "intermediate_cert_badOCSP",
|
||||
"severity" : "OK",
|
||||
"finding" : "intermediate certificate(s) is/are ok"
|
||||
}
|
||||
],
|
||||
"headerResponse" : [
|
||||
{
|
||||
"id" : "HTTP_status_code",
|
||||
"severity" : "INFO",
|
||||
"finding" : "404 Not Found ('/')"
|
||||
},{
|
||||
"id" : "HTTP_clock_skew",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 seconds from localtime"
|
||||
},{
|
||||
"id" : "HTTP_headerTime",
|
||||
"severity" : "INFO",
|
||||
"finding" : "1793779861"
|
||||
},{
|
||||
"id" : "HSTS",
|
||||
"severity" : "LOW",
|
||||
"finding" : "not offered"
|
||||
},{
|
||||
"id" : "HPKP",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No support for HTTP Public Key Pinning"
|
||||
},{
|
||||
"id" : "banner_server",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No Server banner line in header, interesting!"
|
||||
},{
|
||||
"id" : "banner_application",
|
||||
"severity" : "INFO",
|
||||
"finding" : "X-Powered-By: Express"
|
||||
},{
|
||||
"id" : "cookie_count",
|
||||
"severity" : "INFO",
|
||||
"finding" : "0 at '/' (maybe missed the application)"
|
||||
},{
|
||||
"id" : "Access-Control-Allow-Origin",
|
||||
"severity" : "INFO",
|
||||
"finding" : "*"
|
||||
},{
|
||||
"id" : "banner_reverseproxy",
|
||||
"severity" : "INFO",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "--"
|
||||
}
|
||||
],
|
||||
"vulnerabilities" : [
|
||||
{
|
||||
"id" : "heartbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0160",
|
||||
"cwe" : "CWE-119",
|
||||
"finding" : "not vulnerable, no heartbeat extension"
|
||||
},{
|
||||
"id" : "CCS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-0224",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ticketbleed",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-9244",
|
||||
"cwe" : "CWE-200",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "ROBOT",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||
"cwe" : "CWE-203",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "secure_renego",
|
||||
"severity" : "OK",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "supported"
|
||||
},{
|
||||
"id" : "secure_client_renego",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-1473",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, mitigated"
|
||||
},{
|
||||
"id" : "CRIME_TLS",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2012-4929",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "BREACH",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-3587",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||
},{
|
||||
"id" : "POODLE_SSL",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-3566",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no SSLv3"
|
||||
},{
|
||||
"id" : "fallback_SCSV",
|
||||
"severity" : "OK",
|
||||
"finding" : "no protocol below TLS 1.2 offered"
|
||||
},{
|
||||
"id" : "SWEET32",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||
"cwe" : "CWE-327",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "FREAK",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-0204",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "DROWN",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable on this host and port"
|
||||
},{
|
||||
"id" : "DROWN_hint",
|
||||
"severity" : "INFO",
|
||||
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||
},{
|
||||
"id" : "LOGJAM",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||
},{
|
||||
"id" : "LOGJAM-common_primes",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2015-4000",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "no DH key with <= TLS 1.2"
|
||||
},{
|
||||
"id" : "BEAST",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2011-3389",
|
||||
"cwe" : "CWE-20",
|
||||
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||
},{
|
||||
"id" : "LUCKY13",
|
||||
"severity" : "LOW",
|
||||
"cve" : "CVE-2013-0169",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||
},{
|
||||
"id" : "winshock",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2014-6321",
|
||||
"cwe" : "CWE-94",
|
||||
"finding" : "not vulnerable"
|
||||
},{
|
||||
"id" : "RC4",
|
||||
"severity" : "OK",
|
||||
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||
"cwe" : "CWE-310",
|
||||
"finding" : "not vulnerable"
|
||||
}
|
||||
],
|
||||
"cipherTests" : [
|
||||
|
||||
],
|
||||
"browserSimulations": [
|
||||
{
|
||||
"id" : "clientsimulation-android_70",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-android_90",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_X",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_11_12",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_13_14",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-android_15",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chrome_101_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-chromium_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_100_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-firefox_137_win11",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_8_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win7",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_winphone81",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-ie_11_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_15_win10",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_ios_184",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_154_osx_1231",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-safari_184_osx_154",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_7u25",
|
||||
"severity" : "INFO",
|
||||
"finding" : "No connection"
|
||||
},{
|
||||
"id" : "clientsimulation-java_80442",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1102",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_1703",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-java_2106",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-go_1178",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-libressl_336",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_102e",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_111d",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_315",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-openssl_350",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
},{
|
||||
"id" : "clientsimulation-apple_mail_16_0",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||
},{
|
||||
"id" : "clientsimulation-thunderbird_91_9",
|
||||
"severity" : "INFO",
|
||||
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||
}
|
||||
],
|
||||
"rating" : [
|
||||
{
|
||||
"id" : "rating_spec",
|
||||
"severity" : "INFO",
|
||||
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||
},{
|
||||
"id" : "rating_doc",
|
||||
"severity" : "INFO",
|
||||
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||
},{
|
||||
"id" : "protocol_support_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "100"
|
||||
},{
|
||||
"id" : "protocol_support_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "30"
|
||||
},{
|
||||
"id" : "key_exchange_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "key_exchange_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "27"
|
||||
},{
|
||||
"id" : "cipher_strength_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "90"
|
||||
},{
|
||||
"id" : "cipher_strength_score_weighted",
|
||||
"severity" : "INFO",
|
||||
"finding" : "36"
|
||||
},{
|
||||
"id" : "final_score",
|
||||
"severity" : "INFO",
|
||||
"finding" : "93"
|
||||
},{
|
||||
"id" : "overall_grade",
|
||||
"severity" : "OK",
|
||||
"finding" : "A+"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scanTime" : 74
|
||||
}
|
||||
@@ -0,0 +1,221 @@
|
||||
## Scan started as: "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443"
|
||||
## at kali:/usr/bin/openssl
|
||||
## version testssl: 3.2.4 from
|
||||
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||
|
||||
[7m Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
rDNS (35.205.173.252): --
|
||||
Service detected: HTTP
|
||||
|
||||
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||
|
||||
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||
[1m TLS 1 [mnot offered
|
||||
[1m TLS 1.1 [mnot offered
|
||||
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||
[1m NPN/SPDY [mnot offered
|
||||
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||
|
||||
[1m[4m Testing cipher categories [m
|
||||
|
||||
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||
|
||||
|
||||
[1m[4m Testing server's cipher preferences [m
|
||||
|
||||
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||
-----------------------------------------------------------------------------------------------------------------------------
|
||||
[4mSSLv2[m
|
||||
-
|
||||
[4mSSLv3[m
|
||||
-
|
||||
[4mTLSv1[m
|
||||
-
|
||||
[4mTLSv1.1[m
|
||||
-
|
||||
[4mTLSv1.2[m (server order)
|
||||
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
[4mTLSv1.3[m (server order)
|
||||
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||
|
||||
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||
|
||||
|
||||
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||
|
||||
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||
|
||||
[1m[4m Testing server defaults (Server Hello) [m
|
||||
|
||||
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||
"extended master secret/#23" "session ticket/#35"
|
||||
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||
[1m SSL Session ID support [myes
|
||||
[1m Session Resumption [mTickets: yes, ID: no
|
||||
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||
[1m Certificate Compression [mnone
|
||||
[1m Client Authentication [mnone
|
||||
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||
[1m EV cert[m (experimental) no
|
||||
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||
[1m ETS/"eTLS"[m, visibility info not present
|
||||
[1m Certificate Revocation List [m--
|
||||
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||
[1m OCSP stapling [m[1;33mnot offered[m
|
||||
[1m OCSP must staple extension [m--
|
||||
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||
[1m Certificates provided[m 4
|
||||
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||
|
||||
|
||||
[1m[4m Testing HTTP header response @ "/" [m
|
||||
|
||||
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||
[1m HTTP clock skew [m0 sec from localtime
|
||||
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||
[1m Public Key Pinning [m--
|
||||
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||
[1m Application banner [m[33m[1mX-Powered-By(B[m: Express
|
||||
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||
[1m Reverse Proxy banner [m--
|
||||
|
||||
|
||||
[1m[4m Testing vulnerabilities [m
|
||||
|
||||
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m -- mitigated (disconnect after 4/10 attempts)
|
||||
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||
|
||||
|
||||
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||
|
||||
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||
------------------------------------------------------------------------------------------------
|
||||
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
IE 8 Win 7 No connection
|
||||
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 7u25 No connection
|
||||
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||
|
||||
|
||||
[1m[4m Rating (experimental) [m
|
||||
|
||||
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||
[1m Protocol Support [m(weighted) 100 (30)
|
||||
[1m Key Exchange [m (weighted) 90 (27)
|
||||
[1m Cipher Strength [m (weighted) 90 (36)
|
||||
[1m Final Score [m93
|
||||
[1m Overall Grade [m[1;32mA+[m
|
||||
|
||||
[7m Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||
|
||||
|
||||
Reference in New Issue
Block a user