Compare commits
18
Commits
96f148a770
..
main
| Author | SHA1 | Date | |
|---|---|---|---|
 a.edenhauser
|
2e62320a9e | ||
|
a.edenhauser
|
f15e261346 | ||
|
a.edenhauser
|
20dfd8ba2b | ||
|
a.edenhauser
|
2bf8e28b83 | ||
|
a.edenhauser
|
24e0371de6 | ||
|
a.edenhauser
|
e64e5def57 | ||
|
a.edenhauser
|
6dfb748adf | ||
|
a.edenhauser
|
b381f9b4ea | ||
|
a.edenhauser
|
434b733f58 | ||
|
a.edenhauser
|
ebaead60be | ||
|
a.edenhauser
|
731f5fa2da | ||
|
a.edenhauser
|
40545aef24 | ||
|
a.edenhauser
|
fccc75d98b | ||
|
a.edenhauser
|
d4af084137 | ||
|
a.edenhauser
|
a7603d2367 | ||
|
a.edenhauser
|
0a5593dc92 | ||
|
a.edenhauser
|
e4d0c32686 | ||
|
a.edenhauser
|
cd324e882e |
@@ -11,8 +11,145 @@ TODO:
|
|||||||
|
|
||||||
## 0.1 Services Running on the Device
|
## 0.1 Services Running on the Device
|
||||||
|
|
||||||
|
The system consists of four parts that expose services: the lock (inner/motor module), the outer touch module, the bridge, and the cloud backends used by the LOQED and Shelly apps.
|
||||||
|
|
||||||
|
### Lock
|
||||||
|
|
||||||
|
Its only wireless interface is BLE.
|
||||||
|
|
||||||
|
| Property | Value |
|
||||||
|
| --- | --- |
|
||||||
|
| Advertising name | `Loqed Inside` |
|
||||||
|
| Address | `FF:EC:EE:E7:32:E5`, type PUBLIC (fixed, does not rotate) |
|
||||||
|
| Advertising | Undirected, connectable |
|
||||||
|
| Manufacturer data | Company ID `0xFFFF` (reserved/test ID), payload `0000` |
|
||||||
|
|
||||||
|
The GATT table could be enumerated without pairing and contains three services:
|
||||||
|
|
||||||
|
| Service | Characteristic | Properties | Notes |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| Generic Access (`0x1800`) | Device Name (`0x2A00`) | READ, WRITE | Value `Loqed Inside`. Declared writable. |
|
||||||
|
| | Appearance (`0x2A01`) | READ | `0x0000` (unknown) |
|
||||||
|
| | Peripheral Preferred Connection Parameters (`0x2A04`) | READ | `ffffffff0000ffff` (no preference) |
|
||||||
|
| | Central Address Resolution (`0x2AA6`) | READ | `0x01` (privacy supported, although a public address is used) |
|
||||||
|
| Generic Attribute (`0x1801`) | Service Changed (`0x2A05`) | INDICATE | |
|
||||||
|
| Custom (`bdce0001-e90d-4685-b89d-5578cd199a9f`) | `bdce0101-…` | WRITE | Accepted unauthenticated writes (ToothFairy WRLS-GATT-004) |
|
||||||
|
| | `bdce0102-…` | READ, INDICATE | 33 bytes: `0x01` + 32 high-entropy bytes |
|
||||||
|
| | `bdce0103-…` | WRITE | Accepted unauthenticated writes (ToothFairy WRLS-GATT-004) |
|
||||||
|
| | `bdce0104-…` | READ, INDICATE | 97 bytes: `0x01` + 96 high-entropy bytes |
|
||||||
|
|
||||||
|
The custom service appears to consist of two request/response channels.
|
||||||
|
The readable values look random, which suggests they are encrypted or cryptographic material rather than plaintext state.
|
||||||
|
|
||||||
|
> This is an assumption based on the data, not yet verified.
|
||||||
|
|
||||||
|
According to the bridge firmware analysis, the lock receives commands (lock state changes, time sync, firmware updates in parts) from the bridge over this BLE link.
|
||||||
|
|
||||||
|
#### Wired interfaces
|
||||||
|
|
||||||
|
- UART (115200 8N1): internal link to the touch module carrying a framed binary protocol with display text
|
||||||
|
- SWD: debug port of the nRF52840; no connection could be established
|
||||||
|
|
||||||
|
### Outer Module (Touch)
|
||||||
|
|
||||||
|
No wireless services.
|
||||||
|
|
||||||
|
Connected to the motor module by cable and receives display content over the UART link described above.
|
||||||
|
|
||||||
|
### Bridge (ESP32)
|
||||||
|
|
||||||
|
The bridge connects to WiFi as a client and relays between the cloud and the lock.
|
||||||
|
|
||||||
|
| Service / Connection | Direction | Details |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| BLE central (GATT client) | Bridge → Lock | Scans for, pairs/bonds with and controls the lock |
|
||||||
|
| MQTT over TLS | Bridge → Cloud | `mqtts://mqtt.production.loqed.com:8883` / `production.loqed.com:8883`, topics `locks/<id>/to_lock`, `locks/<id>/to_backend`, `…/state`, `…/status` |
|
||||||
|
| HTTPS | Bridge → Cloud | `gateway.production.loqed.com:443`, `production.loqed.com:8080` |
|
||||||
|
| HTTPS OTA | Bridge → Cloud | `firmware.loqed.com` (firmware for bridge and lock) |
|
||||||
|
| Core dump upload | Bridge → Cloud | `https://app.loqed.com/Bridge-core-dump/bridge-core-dump2.php` |
|
||||||
|
| HTTP (port 80, clear text) | LAN → Bridge | Likely: `10.12.2.17` (MAC `8c:4b:14:6a:1a:cc`, Espressif OUI) answered `GET /shelly` from the app in the init capture, matches the Shelly local device API and the app's mDNS queries for `_shelly._tcp.local` |
|
||||||
|
| UART console (115200) | Physical | Boot log, firmware contains format strings that print tokens and WiFi credentials in clear text |
|
||||||
|
|
||||||
|
Endpoints are taken from the firmware analysis unless stated otherwise.
|
||||||
|
|
||||||
|
### Cloud Backends
|
||||||
|
|
||||||
|
> Observed during initial setup.
|
||||||
|
|
||||||
|
From the PreTester report of the init capture and the nmap scans:
|
||||||
|
|
||||||
|
| Host | IP | Ports observed in capture | Notes |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| `control.shelly.cloud` | `34.95.90.149` | 443 (TLS 1.3) | |
|
||||||
|
| `shelly-101-eu.shelly.cloud` | `34.79.5.199` | 31234 (TLS 1.3) | [nmap](network/nmap/shelly-101-eu-shelly-cloud.nmap): 22 (OpenSSH 9.6p1 Ubuntu), 80 + 443 (nginx 1.24.0, Ubuntu); 443 returns `401` without `WWW-Authenticate` header; 31234 filtered |
|
||||||
|
| `shelly-120-eu.shelly.cloud` | `104.155.32.247` | 443, 6113 (TLS 1.3) | Rescan pending (see 2.6) |
|
||||||
|
| `shelly-infra1-eu.shelly.cloud`, `app-ratings.shelly.cloud`, `paypal.shelly.cloud` | `35.205.173.252` | 443, 9443 (TLS 1.2) | |
|
||||||
|
| `changelog-backend.shelly.cloud` | `34.62.47.252` | 443 (TLS 1.2) | |
|
||||||
|
| `repo.shelly.cloud` | `35.241.201.25` | 443 | |
|
||||||
|
| `integrations.loqed.com` | `34.155.200.196` | 443, 8883 (MQTTS) | |
|
||||||
|
|
||||||
|
All cloud connections in the capture were encrypted (TLS 1.2/1.3 with AEAD cipher suites)
|
||||||
|
|
||||||
|
The only clear-text HTTP flows were captive-portal checks and the local request to `10.12.2.17:80`.
|
||||||
|
|
||||||
|
### Apps
|
||||||
|
|
||||||
|
| App | Package |
|
||||||
|
| --- | --- |
|
||||||
|
| LOQED | `com.loqed.keychain` |
|
||||||
|
| Shelly | `cloud.shelly.smartcontrol` |
|
||||||
|
|
||||||
## 0.2 Hardware and Software Specifications
|
## 0.2 Hardware and Software Specifications
|
||||||
|
|
||||||
|
| Component | Main chip | Firmware | Interfaces |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| Lock (inner/motor module) | Nordic nRF52840 | Unknown (not extracted) | BLE, UART, SWD, I²C |
|
||||||
|
| Outer module (touch) | Unknown (not opened, glued) | Unknown | Cable to motor module (UART) |
|
||||||
|
| Bridge | ESP32-WROVER-B | `LoqedBridge`, ESP-IDF v4.4.1 | WiFi, BLE, UART |
|
||||||
|
|
||||||
|
Power supply: 8× AA batteries (lock).
|
||||||
|
|
||||||
|
The bridge has its own mains power supply beneath the PCB.
|
||||||
|
|
||||||
|
### Lock (Inner/Motor Module)
|
||||||
|
|
||||||
|
| Item | Details |
|
||||||
|
| --- | --- |
|
||||||
|
| SoC | Nordic nRF52840 |
|
||||||
|
| CPU / memory | Arm Cortex-M4F @ 64 MHz, 1 MB internal flash, 256 KB RAM, BLE 5 radio (datasheet values) |
|
||||||
|
| External flash | Macronix MX25R3235F, 4 MB SPI NOR, ultra-low-power, WSON-8 package (U6) |
|
||||||
|
| PCB markings | `LOQED IM31201218 PT2256A4 13Jul2022`, manufacturer marking `HT-M E327182`, `94V0` (flammability rating) |
|
||||||
|
| U7 (`H451`) | SOP-8 next to a 0.22 Ω shunt resistor (`R220`) and the motor/power connectors, likely part of the motor driver or power stage (unverified) |
|
||||||
|
| U4 | Sensor on I²C (SDA/SCL pads), function unverified |
|
||||||
|
| Other components | Buzzer, push button (S1), LED, motor terminals (M1/M2), battery terminals (+/−), connectors for touch module, power supply and motor |
|
||||||
|
| Debug / test points | SWD (`CLK`, `DIO`, `3V3`), 2×5 pad header (likely factory programming), UART (`Rx`, `Tx`, `VCC`, J2: `GND`, `3V3`, `RX`, `TX`, `VEXT`) |
|
||||||
|
| Mechanics | DC gear motor driving a brass worm wheel with a hexagonal shaft for the cylinder |
|
||||||
|
| Firmware | Not extracted, per the bridge firmware, lock updates are downloaded by the bridge from `firmware.loqed.com` and streamed to the lock over BLE in parts |
|
||||||
|
| Lock states (from bridge firmware) | Positions: open / latch / night lock, Triggers: twist assist, touch-to-lock, outside module button/PIN, BLE, remote |
|
||||||
|
|
||||||
|
### Outer Module (Touch)
|
||||||
|
|
||||||
|
| Item | Details |
|
||||||
|
| --- | --- |
|
||||||
|
| Construction | Plastic shell, three screws, additionally glued, not opened to avoid damage |
|
||||||
|
| Function | Touch sensor and display (shows e.g.: "Touch to Lock", "Locking") |
|
||||||
|
| Connection | Cable to the motor module, display content is sent over UART |
|
||||||
|
|
||||||
|
### Bridge
|
||||||
|
|
||||||
|
| Item | Details |
|
||||||
|
| --- | --- |
|
||||||
|
| Module | Espressif ESP32-WROVER-B (ESP32-D0WD, 64 Mbit PSRAM), WiFi 2.4 GHz + Bluetooth/BLE |
|
||||||
|
| Flash | 4 MB, MD5 `847d4795ee64714d3b02e2bdb3d20266` |
|
||||||
|
| Framework | ESP-IDF v4.4.1, project `LoqedBridge` |
|
||||||
|
| Build | Git commit `33beadfc1ba5d4d3b0cb6a6ee673535a1d12972c`, version string `33beadf-dirty` (built from an uncommitted working tree) |
|
||||||
|
| Security features | `secure_boot_v1` (per boot log), NVS encryption (`nvs_key` partition) |
|
||||||
|
| Partitions | `nvs` (16K), `nvs_key` (4K), `otadata` (8K), `phy_init` (4K), `factory` / `ota_0` / `ota_1` (1280K each), `coredump` (64K) |
|
||||||
|
| Update mechanism | HTTPS OTA with A/B partitions and rollback, for both bridge and lock |
|
||||||
|
| Crypto library | mbedTLS (AES, RSA, EC, SHA-1/SHA-256), standard CA trust store bundled, no embedded private keys |
|
||||||
|
| Debug interface | UART (115200), used for boot log and firmware read-out via `esptool` |
|
||||||
|
| Other | Reset button, developer paths leaked in strings (`/home/pierre/bridge/…`, `/root/bridge/…`) |
|
||||||
|
|
||||||
## 0.3 Known Vulnerabilities / Problems / Hacks
|
## 0.3 Known Vulnerabilities / Problems / Hacks
|
||||||
|
|
||||||
No known vulnerabilities or hacks were found during research or on CVE.
|
No known vulnerabilities or hacks were found during research or on CVE.
|
||||||
@@ -25,6 +162,19 @@ Common issues for consumers include:
|
|||||||
|
|
||||||
## 0.4 Collecting APKs
|
## 0.4 Collecting APKs
|
||||||
|
|
||||||
|
Using the rooted Google Pixel and `adb`, I was able to obtain the [Shelly app](app_apks/shelly.apk).:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
adb pull $(adb shell pm path cloud.shelly.smartcontrol | tr -d '\r') ./shelly.apk
|
||||||
|
```
|
||||||
|
|
||||||
|
Additionally, I found out that there is a specific [LOQED app](app_apks/loqed.apk) as well, which I also obtained:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
adb pull $(adb shell pm path com.loqed.keychain | grep base.apk | tr -d '\r') ./loqed.apk
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
## 1.1 && 2.1 Unpacking
|
## 1.1 && 2.1 Unpacking
|
||||||
|
|
||||||
The packaging contains:
|
The packaging contains:
|
||||||
@@ -112,19 +262,64 @@ After unplugging all cables, the PCB can be leveraged out of the shell with a fl
|
|||||||
Here you can see:
|
Here you can see:
|
||||||
- UART
|
- UART
|
||||||
- $I^2C$
|
- $I^2C$
|
||||||
- SoC and access pins
|
- Most likely an nRF52840
|
||||||
- A buzzer and a button
|
- A buzzer and a button
|
||||||
|
|
||||||
## 1.5 Software Components from Firmware Analysis
|
## 1.5 Software Components from Firmware Analysis
|
||||||
|
|
||||||
|
Only the bridge firmware could be extracted, so this section covers the bridge
|
||||||
|
The components below were identified through static analysis.
|
||||||
|
|
||||||
|
Apart from ESP-IDF, no component versions are embedded as strings, the versions of the bundled libraries follow from the ESP-IDF release.
|
||||||
|
|
||||||
|
### Bridge
|
||||||
|
|
||||||
|
| Component | Version / Source | Evidence | Purpose |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| ESP-IDF | v4.4.1 | Version string in image | Espressif's SDK and build framework |
|
||||||
|
| FreeRTOS | Bundled with ESP-IDF v4.4.1 | Part of every ESP-IDF application | Real-time operating system |
|
||||||
|
| Bluedroid BLE stack | Bundled with ESP-IDF | `esp_ble_gattc_*`, `ESP_GAP_BLE_AUTH_CMPL_EVT` | BLE central: scanning, pairing/bonding, GATT client to the lock |
|
||||||
|
| WiFi driver | Bundled with ESP-IDF | `ap.authmode`, `ap.passwd`, "Set WiFi credentials" | WiFi station; credentials provisioned and stored in NVS |
|
||||||
|
| mbedTLS | Bundled with ESP-IDF | mbedTLS label tables, SHA-256 constants, AES/RSA/EC code, TLS-PSK paths | TLS and cryptography |
|
||||||
|
| CA certificate store | Standard ESP/mbedTLS bundle | Public CA certificates (Entrust, COMODO, Starfield, …) | TLS server certificate validation |
|
||||||
|
| MQTT client | ESP-IDF MQTT component (likely `esp-mqtt`) | `mqtts://` URLs, MQTT auth error strings | Cloud connection to `mqtt.production.loqed.com:8883` |
|
||||||
|
| HTTP client / HTTPS OTA | ESP-IDF `esp_http_client`, `esp_https_ota` | `esp_https_ota_*` | Firmware downloads for bridge and lock |
|
||||||
|
| OTA / app update | ESP-IDF `app_update` | `otadata`, `ota_0` / `ota_1` partitions, rollback, image magic `0xE9` | A/B updates with rollback |
|
||||||
|
| NVS with encryption | ESP-IDF `nvs_flash` | `nvs` and `nvs_key` (subtype 0x04) partitions | Encrypted storage of device identity, tokens and WiFi credentials |
|
||||||
|
| Secure boot | ESP-IDF secure boot v1 | `secure_boot_v1` in boot log | Bootloader/app signature verification |
|
||||||
|
| Core dump | ESP-IDF `espcoredump` | `coredump` partition, upload URL | Crash dumps, uploaded to `app.loqed.com` |
|
||||||
|
| Button driver | `iot_button` from Espressif's esp-iot-solution | Path `components/button_driver/iot_button.c` | Reset button handling |
|
||||||
|
| `LoqedBridge` application | Custom, commit `33beadf` (`-dirty`) | Project name, git hash | BLE ↔ MQTT relay, command protocol, lock/bridge OTA logic |
|
||||||
|
|
||||||
|
The custom application implements:
|
||||||
|
- a binary command protocol between backend, bridge and lock (`REQUEST_STATUS_INFO_BRIDGE`, `COMMAND_ELECTRONIC_DOOR`, `COMMAND_LOCK_FIRMWARE_UPGRADE`, `REQUEST_TIME_FROM_BRIDGE`, …)
|
||||||
|
- the lock state machine (`GO_TO_STATE_*`: open / latch / night lock via twist assist, touch-to-lock, outside module, BLE or remote)
|
||||||
|
- lock firmware delivery: the bridge downloads lock firmware from `firmware.loqed.com` and sends it to the lock over BLE in parts
|
||||||
|
|
||||||
|
#### Security-Relevant Observations
|
||||||
|
|
||||||
|
- The firmware prints tokens and WiFi credentials to the UART console (`token: %s`, `auth_token: %s`, `Setting wifi credentials to:`)
|
||||||
|
- It was built from an uncommitted working tree (`-dirty`), and developer paths are left in the binary (`/home/pierre/bridge/…`, `/root/bridge/…`)
|
||||||
|
- ESP-IDF v4.4.1 is from 2022, the bundled components (Bluedroid, mbedTLS, WiFi driver) should be checked against known CVEs for that release
|
||||||
|
|
||||||
|
### Lock (Inner Module)
|
||||||
|
|
||||||
|
The lock firmware could not be extracted, so its components are unknown.
|
||||||
|
|
||||||
|
What can be said from the outside:
|
||||||
|
- It runs on the nRF52840, so it is most likely built on Nordic's nRF5 SDK with a SoftDevice or on the nRF Connect SDK (Zephyr)
|
||||||
|
- No standard Nordic DFU service is exposed over BLE (ToothFairy WRLS-GATT-002), updates use the bridge's custom transfer mechanism instead
|
||||||
|
- It implements a custom GATT service (`bdce0001-…`) and the UART display protocol to the touch module
|
||||||
|
|
||||||
## 1.6 Collect "Fresh" Firmware Dump
|
## 1.6 Collect "Fresh" Firmware Dump
|
||||||
|
|
||||||
The device has been tampered with before, therefore there is no fresh dump available.
|
The device has been tampered with before, therefore there is no "fresh" dump available.
|
||||||
|
|
||||||
## 1.7 && 2.3 Initial setup
|
## 1.7 && 2.3 Initial setup
|
||||||
|
|
||||||
The initial setup is done using the Shelly App. The capture can be found [here](captures/init.pcapng).
|
The initial setup is done using the LOQED app, the lock can then be integrateed into the Shelly app. The capture can be found [here](network/captures/init.pcapng).
|
||||||
|
|
||||||
|
Additionally, the Shelly app offers to download the data stored on the device, which you can find [here](lock_data/after_init/README.md).
|
||||||
|
|
||||||
Unsure which IP address is most relevant, here are all Shelly-like or LOQED-like addresses:
|
Unsure which IP address is most relevant, here are all Shelly-like or LOQED-like addresses:
|
||||||
- `34.62.47.252`: changelog-backend.shelly.cloud0
|
- `34.62.47.252`: changelog-backend.shelly.cloud0
|
||||||
@@ -140,15 +335,15 @@ As the bridge has a built in ESP32 supporting WiFi, I suspect the communication
|
|||||||
|
|
||||||
<img src="img/sequence_diagram.png" alt="PlantUML sequence diagram of suspected communication flow" width="400">
|
<img src="img/sequence_diagram.png" alt="PlantUML sequence diagram of suspected communication flow" width="400">
|
||||||
|
|
||||||
The [PreTester report](pretester_reports/init_report.md) didn't find anything unusual.
|
The [PreTester report](network/pretester_reports/init_report.md) didn't find anything unusual.
|
||||||
It reported no critical or high findings.
|
It reported no critical or high findings.
|
||||||
|
|
||||||
### Old Initial Setup Capture
|
### Old Initial Setup Capture
|
||||||
|
|
||||||
You can also find an older initial setup capture made by Manu [here](captures/old_init.pcapng).
|
You can also find an older initial setup capture made by Manu [here](network/captures/old_init.pcapng).
|
||||||
I tested this in the PreTester as well using integrations.loqed.com, as this seemed to be the most present IP in the capture.
|
I tested this in the PreTester as well using integrations.loqed.com, as this seemed to be the most present IP in the capture.
|
||||||
|
|
||||||
The [report](pretester_reports/old_init_report.md) can be found here.
|
The [report](network/pretester_reports/old_init_report.md) can be found here.
|
||||||
Once again, it reported no critical or high findings.
|
Once again, it reported no critical or high findings.
|
||||||
|
|
||||||
> The old init capture supposedly was the first real fresh setup. As mentioned, the lock has been tempered with before.
|
> The old init capture supposedly was the first real fresh setup. As mentioned, the lock has been tempered with before.
|
||||||
@@ -158,8 +353,8 @@ Once again, it reported no critical or high findings.
|
|||||||
I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings:
|
I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings:
|
||||||
|
|
||||||
While most of ports are common for HTTPS and SSH, there are a few interesting ones:
|
While most of ports are common for HTTPS and SSH, there are a few interesting ones:
|
||||||
- 31234 onshelly-101-eu.shelly.cloud: [Nmap scan](nmap/shelly-101-eu-shelly-cloud.nmap) revealed no more information
|
- 31234 onshelly-101-eu.shelly.cloud: [Nmap scan](network/nmap/shelly-101-eu-shelly-cloud.nmap) revealed no more information
|
||||||
- 6113 on shelly-120-eu.shelly.cloud: [Nmap scan](nmap/shelly-120-eu-shelly-cloud.nmap) found ports 6115, 6022, 8007, 6114
|
- 6113 on shelly-120-eu.shelly.cloud: [Nmap scan](network/nmap/shelly-120-eu-shelly-cloud.nmap) found ports 6115, 6022, 8007, 6114
|
||||||
- It may be important to note that scan took significantly more time (almost 1h) and was eventually aborted
|
- It may be important to note that scan took significantly more time (almost 1h) and was eventually aborted
|
||||||
- **#TODO: RESCAN**
|
- **#TODO: RESCAN**
|
||||||
- 9443 on shelly-infra1-eu.shelly.cloud: widely recognized as an alternative or **administrative** HTTPS port
|
- 9443 on shelly-infra1-eu.shelly.cloud: widely recognized as an alternative or **administrative** HTTPS port
|
||||||
@@ -170,34 +365,72 @@ Some playing around with Metasploit's `check` on these 2 cloud endpoints couldn'
|
|||||||
## 2.7 BLE
|
## 2.7 BLE
|
||||||
|
|
||||||
I ran ToothFairy on the lock. It's advertising name is "Loqed Inside" and it uses a fixed MAC address `FF:EC:EE:E7:32:E5`.
|
I ran ToothFairy on the lock. It's advertising name is "Loqed Inside" and it uses a fixed MAC address `FF:EC:EE:E7:32:E5`.
|
||||||
|
I obtained the [GATT table](ble/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](ble/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of HW.
|
||||||
I obtained the [GATT table](toothfairy_reports/gatt_FF-EC-EE-E7-32-E5_20261023_085131.json) and a very incomplete [test report](toothfairy_reports/toothfairy_report_FFECEEE732E5_20261023_085351.json), due to a lack of hardware.
|
|
||||||
|
|
||||||
However, ToothFairy labelled `WRLS-FUZZ-002` as `FAIL`, due to the target not recovering after malformed packets were sent.
|
However, ToothFairy labelled `WRLS-FUZZ-002` as `FAIL`, due to the target not recovering after malformed packets were sent.
|
||||||
|
|
||||||
|
### Sniffing
|
||||||
|
|
||||||
|
After obtaining the needed HW, I tried snifing the app connection process and sent a lock/unlock command, none of which showed ATT protocol packets. This could be due to:
|
||||||
|
- Encryption on the link layer
|
||||||
|
- The sniffer struggling with frequency hopping (nRF nordic)
|
||||||
|
|
||||||
## 1.8 Collect Firmware Dump of Firmware after initial Setup
|
## 1.8 Collect Firmware Dump of Firmware after initial Setup
|
||||||
|
|
||||||
### Bridge
|
### Bridge
|
||||||
|
|
||||||
### Outer Module
|
Hooking up the bridge using UART with a baud rate of 15200 revealed its [boot process](firmware/bridge/boot.txt).
|
||||||
|
Using an older version of esptool, I was able to obtain the [firmware](firmware/bridge/firmware.bin):
|
||||||
|
|
||||||
## 1.9 && 2.4 Firmware Update
|
```bash
|
||||||
|
pipx run --spec esptool==3.3.2 esptool.py -p /dev/ttyUSB1 -b 115200 read_flash 0 0x400000 full_firmware.bin
|
||||||
|
```
|
||||||
|
|
||||||
## 1.10 Collect Updated Firmware Dump
|
> Writing this down in case I need it again.
|
||||||
|
|
||||||
### Bridge
|
#### FW Analysis
|
||||||
|
|
||||||
### Outer Module
|
I found an [IoT FW analysis tool](https://github.com/ericyoc/iot_device_firmware_analysis_poc/tree/main) on GitHub, which I used for generating a quick [report](firmware/bridge/report.txt).
|
||||||
|
|
||||||
|
##### Reverse Engineer Anything
|
||||||
|
|
||||||
|
Using [REA](https://github.com/morluto/rea), we ran the firmware through Claude Code and received a short [report](firmware/bridge/claude_firmware_analysis.md).
|
||||||
|
|
||||||
|
### Inner Module
|
||||||
|
|
||||||
|
Using UART with a baud rate of 115200, I was able to log the boot process & runtime traffic.
|
||||||
|
It seems that the UART link is used for displaying text onto the touch module's display, as you can see it writing whatever the touch module is currently showing. E.g.: "Touch To Lock" or "Locking". Inspect the data [here](firmware/inner_module/inner_module_uart.txt).
|
||||||
|
|
||||||
|
In picocom, the device didn't react to any text-based commands.
|
||||||
|
|
||||||
|
I also wasn't able to obtain the FW using the test clip from the H451 chip (unknown by mini programmer) or the NOR flash (couldn't grab it).
|
||||||
|
|
||||||
|
I tried SWD using the j-link mini, but it kept resulting in an error.
|
||||||
|
|
||||||
|
It seems the extraction of the motor module FW exceeds this test.
|
||||||
|
|
||||||
|
## 1.9 && 2.4 Firmware Update / 1.10 Collect Updated Firmware Dump
|
||||||
|
|
||||||
|
There is no FW update available.
|
||||||
|
|
||||||
## 1.11 Collect Firmware Dump after Factory Reset
|
## 1.11 Collect Firmware Dump after Factory Reset
|
||||||
|
|
||||||
### Bridge
|
### Bridge
|
||||||
|
|
||||||
### Outer Module
|
You can find the firmware after a full reset [here](firmware/bridge/reset_fw.bin).
|
||||||
|
|
||||||
## 1.12 (Optional for now) Instantiate Device Model
|
I generated a [report](firmware/bridge/reset_fw_report.txt) using the same IoT FW analysis tool.
|
||||||
|
|
||||||
## 1.13 Collect App APKs
|
These are the differences:
|
||||||
|
- After reset: MD5 a3ae4e32c155426e5a163429fd35ce74
|
||||||
|
- Before: MD5 847d4795ee64714d3b02e2bdb3d20266
|
||||||
|
- Not byte-for-byte identical, firmware itself is unchanged
|
||||||
|
- Only differing string is a single value (`MMNHB<84` vs `LLNHB<84`)
|
||||||
|
|
||||||
|
> Further & deeper analysis of the FW will be done later on as it exceeds a "simple" informartion gathering.
|
||||||
|
|
||||||
## 2.5 Inspection of Device During Normal Usage
|
## 2.5 Inspection of Device During Normal Usage
|
||||||
|
|
||||||
|
The lock works as expected, the only issue seems to be the touch module which is often delayed or doesn't properly react to input.
|
||||||
|
|
||||||
|
Nothing interesting other than that.
|
||||||
@@ -0,0 +1,120 @@
|
|||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
| ------- | -------------- | ---- | ----- | ------ | ------- |
|
||||||
|
| DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. |
|
||||||
|
| DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code | Open | Test not yet performed. |
|
||||||
|
| DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. |
|
||||||
|
| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | PASS (with findings) | Device: no outdated software on the bridge's exposed interface. Ecosystem (LOQED/Shelly cloud): TLS broadly strong, but low/medium hardening issues, client-initiated renegotiation on `shelly-120:6113` (DoS), TLS 1.3 absent on 2 hosts, outdated nginx 1.21.6 on integrations, version/OS & Express banners, shared `*.shelly.cloud wildcard cert`, missing HSTS, BREACH preconditions on 2 hosts. |
|
||||||
|
| DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | PASS | No unnecesarrily open ports on the bridge |
|
||||||
|
| DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. |
|
||||||
|
| DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. |
|
||||||
|
| DES-12 | ISTG-DES-INPV-001 | Insufficient Input Validation (Network API) | mitm | Open | Test not yet performed. |
|
||||||
|
| DES-13 | ISTG-DES-INPV-002 | Code or Command Injection (Network API) | mitm | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Test Case Execution
|
||||||
|
|
||||||
|
### DES-02
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
|
|
||||||
|
### DES-06
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
|
|
||||||
|
### DES-07
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
|
|
||||||
|
### DES-08
|
||||||
|
|
||||||
|
The DES considered for this test are:
|
||||||
|
- `mqtt.production.loqed.com:8883`
|
||||||
|
- `integrations.loqed.com:443`
|
||||||
|
- No HSTS header
|
||||||
|
- Outdated nginx
|
||||||
|
- `api.production.loqed.com:443`
|
||||||
|
- No HSTS header
|
||||||
|
- All of the above:
|
||||||
|
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||||
|
|
||||||
|
|
||||||
|
And the shelly cloud services:
|
||||||
|
- `control.shelly.cloud:443`
|
||||||
|
- No HSTS header
|
||||||
|
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||||
|
- Potentially vuln. to CVE-2013-3587
|
||||||
|
- Google’s/Shelly’s hosting config
|
||||||
|
- `shelly-120-eu.shelly.cloud:443`
|
||||||
|
- No HSTS header
|
||||||
|
- Exposes nginx and Ubuntu OS
|
||||||
|
- `:6113`
|
||||||
|
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||||
|
- **Vulnerable to secure client-initiated renegotiation**
|
||||||
|
- `shelly-101-eu.shelly.cloud:31234`
|
||||||
|
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||||
|
- No HSTS header
|
||||||
|
- `shelly-infra1-eu.shelly.cloud:443`
|
||||||
|
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||||
|
- No HSTS header
|
||||||
|
- Exposes nginx and Ubuntu OS
|
||||||
|
- **No TLS 1.3**
|
||||||
|
- `:9443`
|
||||||
|
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||||||
|
- Exposes application banner x-powered-by express
|
||||||
|
- No HSTS header
|
||||||
|
- `changelog-backend.shelly.cloud:443`
|
||||||
|
- **No TLS 1.3**
|
||||||
|
- Exposes nginx and Ubuntu OS
|
||||||
|
- Potentially vuln. to CVE-2013-3587
|
||||||
|
- Google’s/Shelly’s hosting config
|
||||||
|
- `repo.shelly.cloud:443`
|
||||||
|
- Exposes nginx and Ubuntu OS
|
||||||
|
- All `*.shelly.cloud` use wildcard cert.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
testssl -oA <output> <target>
|
||||||
|
```
|
||||||
|
|
||||||
|
- **Results**: [testssl reports](test_case_evidence/DES/DES08/)
|
||||||
|
|
||||||
|
- **Verdict: PASS (with findings)**
|
||||||
|
|
||||||
|
### DES-09
|
||||||
|
|
||||||
|
Some ports have already been scanned, see [initial information gathering](Document0-Initial_Information_Gathering.md).
|
||||||
|
|
||||||
|
```bash
|
||||||
|
nmap -p 1-65535 -T4 -A -v 10.12.2.30
|
||||||
|
```
|
||||||
|
|
||||||
|
> Zenmap's "intense scan, all TCP ports".
|
||||||
|
|
||||||
|
The bridge is the only device with an IP network interface (the lock is BLE-only).
|
||||||
|
In our network it currently has the address `10.12.2.30`.
|
||||||
|
|
||||||
|
> After the factory reset I had to reconfigure the bridge to determine its new IP.
|
||||||
|
> The procedure was captured [here](network/captures/init_after_reset.pcapng) and re-run through the PreTester [here](network/pretester_reports/init_after_reset_report.md).
|
||||||
|
|
||||||
|
- **Result**: [nmap report](test_case_evidence/DES/DES09/des09_bridge.nmap)
|
||||||
|
|
||||||
|
Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext).
|
||||||
|
All other ports are filtered.
|
||||||
|
|
||||||
|
- **Verdict: PASS**
|
||||||
|
|
||||||
|
### DES-10
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
|
|
||||||
|
### DES-11
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
|
|
||||||
|
### DES-12
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
|
|
||||||
|
### DES-13
|
||||||
|
|
||||||
|
- **Verdict: Open**
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
| ------- | -------------- | ---- | ----- | ------ | ------- |
|
||||||
|
| FW-04 | ISTG-FW-CONF-001 | Usage of Outdated Software (Firmware Components) | binwalk, strings, grep | Open | Test not yet performed. |
|
||||||
|
| FW-05 | ISTG-FW-CONF-002 | Presence of Unnecessary Software (Debug Tools) | binwalk, find | Open | Test not yet performed. |
|
||||||
|
| FW-06 | ISTG-FW-CONF-003 | Usage of Insecure Configuration (Defaults) | strings, grep | Open | Test not yet performed. |
|
||||||
|
| FW-07 | ISTG-FW-SCRT-001 | Secrets Stored in Public Storage | binwalk, find, openssl | Open | Test not yet performed. |
|
||||||
|
| FW-08 | ISTG-FW-SCRT-002 | Unencrypted Storage of Secrets | binwalk, file | Open | Test not yet performed. |
|
||||||
|
| FW-09 | ISTG-FW-SCRT-003 | Usage of Hardcoded Secrets | strings, grep | Open | Test not yet performed. |
|
||||||
|
| FW-10 | ISTG-FW-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Firmware) | openssl | Open | Test not yet performed. |
|
||||||
|
| MEM-04 | ISTG-MEM-SCRT-001 | Unencrypted Storage of Secrets (Memory/Flash) | binwalk, hexdump | Open | Test not yet performed. |
|
||||||
|
| WRLS-02 | ISTG-WRLS-CONF-001 | Usage of Outdated Software (WiFi Stack) | strings, grep | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Example Commands
|
||||||
|
|
||||||
|
```bash
|
||||||
|
|
||||||
|
```
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
Requires physical access to the device (but no disassembly). Device must be powered on and reachable.
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
| ------- | -------------- | ---- | ----- | ------ | ------- |
|
||||||
|
| DES-01 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | curl, openssl, mitmproxy, tcpdump | Open | Test not yet performed. |
|
||||||
|
| DES-04 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services (Cloud Connection) | | Open | Test not yet performed. |
|
||||||
|
| UI-02 | ISTG-UI-AUTHZ-001 | Unauthorized Access to User Interface (Web UI) | curl | Open | Test not yet performed. |
|
||||||
|
| UI-10 | ISTG-UI-LOGIC-001 | Circumvention of the Intended Business Logic (Factory Reset) | sha256sum, diff | Open | Test not yet performed. |
|
||||||
|
| UI-11 | ISTG-UI-INPV-001 | Insufficient Input Validation (SSID/Password Fields) | curl, python3 | Open | Test not yet performed. |
|
||||||
|
| UI-12 | ISTG-UI-INPV-002 | Code or Command Injection (UI Input Fields) | curl | Open | Test not yet performed. |
|
||||||
|
| WRLS-01 | ISTG-WRLS-AUTHZ-001 | Unauthorized Access to Wireless Interface (BLE command channel) | bleak, Frida, Python | Open | Test not yet performed. |
|
||||||
|
| WRLS-04 | ISTG-WRLS-CRYPT-001 | Usage of Weak Cryptographic Algorithms | jadx, Python | Open | Test not yet performed. |
|
||||||
|
| FWUPDT-04 | ISTG-FW[UPDT]-CRYPT-003 | Insecure Firmware Update Transmission | Wireshark, mitmproxy, tcpdump, tshark | Open | Test not yet performed. |
|
||||||
|
| ECS-02 | ISTG-ECS-CONF-003 | Absence of a Responsible Disclosure Policy | curl, wget | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Example Commands
|
||||||
|
|
||||||
|
```bash
|
||||||
|
|
||||||
|
```
|
||||||
@@ -0,0 +1,56 @@
|
|||||||
|
|
||||||
|
## Combined AV-Comparatives Derived Test Cases
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
| ------- | -------------- | ---- | ----- | ------ | ------- |
|
||||||
|
| AUTH-01 | ISTG-APP-AUTHZ-001 | Password Strength Check (App Account) | curl, manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-02 | ISTG-APP-AUTHZ-001 | Password Requirements Enforcement | manual |Open | Test not yet performed. |
|
||||||
|
| AUTH-03 | ISTG-APP-AUTHZ-002 | Two-Factor Authentication (2FA) available | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-04 | ISTG-APP-AUTHZ-003 | Account Lockout after Failed Login Attempts | curl, python3 |Open | Test not yet performed. |
|
||||||
|
| WRLS-05 | ISTG-WRLS-CONF-002 | Warning when Connecting to Unsecured Network | manual | Open | Test not yet performed. |
|
||||||
|
| STG-01 | ISTG-DES-CONF-003 | Cloud Storage available | manual | Open | Test not yet performed. |
|
||||||
|
| STG-02 | ISTG-DES-CONF-003 | Cloud Storage Duration configurable | manual | Open | Test not yet performed. |
|
||||||
|
| STG-03 | ISTG-DES-CONF-003 | Local Storage available (SD Card / USB) | manual |Open | Test not yet performed. |
|
||||||
|
| STG-04 | ISTG-DES-CONF-003 | NAS Storage available | manual | Open | Test not yet performed. |
|
||||||
|
| APP-01 | ISTG-APP-CONF-001 | Manufacturer Account required for Setup | manual | Open | Test not yet performed. |
|
||||||
|
| APP-02 | ISTG-APP-CONF-002 | App Permissions appropriate (no over-permission) | Android permission checker, manual | Open | Test not yet performed. |
|
||||||
|
| APP-03 | ISTG-APP-CONF-003 | Logout from App possible | manual | Open | Test not yet performed. |
|
||||||
|
| SHA-01 | ISTG-APP-AUTHZ-004 | Shared Access: Administration for other Users | manual |Open | Test not yet performed. |
|
||||||
|
| SHA-02 | ISTG-APP-AUTHZ-004 | Shared Access: Livestream for other Users | manual | Open | Test not yet performed. |
|
||||||
|
| SHA-03 | ISTG-APP-AUTHZ-004 | Shared Access: Recordings for other Users | manual | Open | Test not yet performed. |
|
||||||
|
| SHA-04 | ISTG-APP-AUTHZ-004 | Admin/Non-Admin Access configurable | manual | Open | Test not yet performed. |
|
||||||
|
| SHA-05 | ISTG-APP-AUTHZ-005 | Public Browser Access: Livestream configurable | curl, browser | Open | Test not yet performed. |
|
||||||
|
| SHA-06 | ISTG-APP-AUTHZ-005 | Public Browser Access: Password Protection configurable | curl, browser | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Mapping: AV-Comparatives Test → Internal Test Cases
|
||||||
|
|
||||||
|
| AV-Comparatives Category | AV Test Question | Internal Test-ID | Name |
|
||||||
|
| ------------------------ | ---------------- | ---------------- | ---- |
|
||||||
|
| Login / Password | Check of password strength | AUTH-01 | Password Strength Check (App Account) |
|
||||||
|
| Login / Password | Password requirements | AUTH-02 | Password Requirements Enforcement |
|
||||||
|
| Login / Password | Two-factor authentication (2FA) | AUTH-03 | Two-Factor Authentication (2FA) available |
|
||||||
|
| Login / Password | Lockout after failed login attempts | AUTH-04 | Account Lockout after Failed Login Attempts |
|
||||||
|
| Wi-Fi Connection | Warning if network is unsecured | WRLS-05 | Warning when Connecting to Unsecured Network |
|
||||||
|
| Storage | Cloud storage available | STG-01 | Cloud Storage available |
|
||||||
|
| Storage | Configurable cloud storage duration | STG-02 | Cloud Storage Duration configurable |
|
||||||
|
| Storage | Local storage available | STG-03 | Local Storage available (SD Card / USB) |
|
||||||
|
| Storage | Network attached storage (NAS) | STG-04 | NAS Storage available |
|
||||||
|
| App | Manufacturer account required | APP-01 | Manufacturer Account required for Setup |
|
||||||
|
| App | Required permissions appropriate | APP-02 | App Permissions appropriate |
|
||||||
|
| App | Logout from app possible | APP-03 | Logout from App possible |
|
||||||
|
| Shared Access | Other users: Administration | SHA-01 | Shared Access: Administration for other Users |
|
||||||
|
| Shared Access | Other users: Live stream | SHA-02 | Shared Access: Livestream for other Users |
|
||||||
|
| Shared Access | Other users: Recordings | SHA-03 | Shared Access: Recordings for other Users |
|
||||||
|
| Shared Access | Configurable Admin / Non-Admin access | SHA-04 | Admin/Non-Admin Access configurable |
|
||||||
|
| Public Browser Access | Configurable live stream access | SHA-05 | Public Browser Access: Livestream configurable |
|
||||||
|
| Public Browser Access | Configurable password protection | SHA-06 | Public Browser Access: Password Protection configurable |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Example Commands
|
||||||
|
|
||||||
|
```bash
|
||||||
|
|
||||||
|
```
|
||||||
@@ -0,0 +1,121 @@
|
|||||||
|
## Authentication & Password Management
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| AUTH-05 | ISTG-APP-AUTHZ-001 | Default Password Present | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-06 | ISTG-APP-AUTHZ-001 | Device-Specific Default Password Generation | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-07 | ISTG-APP-AUTHZ-001 | Empty Password Input Validation | curl, manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-08 | ISTG-APP-AUTHZ-001 | Password Confirmation Field Verification | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-09 | ISTG-APP-AUTHZ-002 | Password Strength Feedback to User | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-10 | ISTG-APP-AUTHZ-003 | Authentication Before Accessing Sensitive Device Data | curl, browser | Open | Test not yet performed. |
|
||||||
|
| AUTH-11 | ISTG-APP-AUTHZ-003 | Sensitive Data Exposure Before Authentication | Wireshark, tcpdump | Open | Test not yet performed. |
|
||||||
|
| AUTH-12 | ISTG-APP-AUTHZ-003 | Authentication Data Encryption During Transmission | Wireshark, tcpdump | Open | Test not yet performed. |
|
||||||
|
| AUTH-13 | ISTG-APP-AUTHZ-003 | Authentication Data Integrity Protection | Wireshark, mitmproxy | Open | Test not yet performed. |
|
||||||
|
| AUTH-14 | ISTG-APP-AUTHZ-003 | Authentication Status Timeout (Auto Logout) | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-15 | ISTG-APP-AUTHZ-003 | Display of Last Successful Login | manual | Open | Test not yet performed. |
|
||||||
|
| AUTH-16 | ISTG-APP-AUTHZ-003 | Ability to Block Specific Entities | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Firmware Update Security
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| FWUPDT-05 | ISTG-FW[UPDT]-CONF-001 | Manual Firmware Update Availability | manual | Open | Test not yet performed. |
|
||||||
|
| FWUPDT-06 | ISTG-FW[UPDT]-AUTHZ-001 | Authentication Required for Firmware Update | manual | Open | Test not yet performed. |
|
||||||
|
| FWUPDT-07 | ISTG-FW[UPDT]-CONF-002 | Automatic Firmware Update Configuration | manual | Open | Test not yet performed. |
|
||||||
|
| FWUPDT-08 | ISTG-FW[UPDT]-CONF-003 | Firmware Update File Validation (Format Check) | binwalk, file | Open | Test not yet performed. |
|
||||||
|
| FWUPDT-09 | ISTG-FW[UPDT]-CONF-004 | Firmware Update Integrity Verification (Checksum) | sha256sum | Open | Test not yet performed. |
|
||||||
|
| FWUPDT-10 | ISTG-FW[UPDT]-CONF-005 | Device Recovery After Failed Update | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Physical Security
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| PHY-01 | ISTG-PHY-CONF-001 | Unique Device Physical Identifier | manual | Open | Test not yet performed. |
|
||||||
|
| PHY-02 | ISTG-PHY-CONF-002 | Serial Number Visibility | manual | Open | Test not yet performed. |
|
||||||
|
| PHY-03 | ISTG-PHY-AUTHZ-001 | Physical Factory Reset Protection | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Interfaces & Network Exposure
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| INT-01 | ISTG-DES-CONF-004 | Unused Logical Interfaces Disabled | nmap | Open | Test not yet performed. |
|
||||||
|
| INT-02 | ISTG-DES-CONF-005 | Unnecessary Physical Interfaces Exposure | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Communication Security
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| COMM-01 | ISTG-DES-CRYPT-002 | Encryption Between Device and Server | Wireshark, tcpdump | Open | Test not yet performed. |
|
||||||
|
| COMM-02 | ISTG-DES-CRYPT-003 | Encryption Between Device and User | Wireshark, jadx, Python | Open | Test not yet performed. |
|
||||||
|
| COMM-03 | ISTG-DES-INPV-003 | Integrity Check of Received Data | jadx, Python | Open | Test not yet performed. |
|
||||||
|
| COMM-04 | ISTG-DES-SESS-001 | Session Management and Identifier Tracking | Wireshark | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Boot & Software Integrity
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| BOOT-01 | ISTG-FW-SCRT-004 | Secure Boot Mechanism Protection | binwalk, strings | Open | Test not yet performed. |
|
||||||
|
| BOOT-02 | ISTG-FW-SCRT-005 | Detection of Unauthorized Software Modification | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Logging & Audit
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| LOG-01 | ISTG-LOG-CONF-001 | Event Logging Availability | manual | Open | Test not yet performed. |
|
||||||
|
| LOG-02 | ISTG-LOG-SCRT-001 | Secure Storage of Logs | manual | Open | Test not yet performed. |
|
||||||
|
| LOG-03 | ISTG-LOG-SCRT-002 | Log Integrity Protection | manual | Open | Test not yet performed. |
|
||||||
|
| LOG-04 | ISTG-LOG-AUTHZ-001 | Authentication Required to Access Logs | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## User Roles & Account Management
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| ROLE-01 | ISTG-APP-AUTHZ-006 | Creation of Multiple User Accounts | manual | Open | Test not yet performed. |
|
||||||
|
| ROLE-02 | ISTG-APP-AUTHZ-006 | Role Assignment to User Accounts | manual | Open | Test not yet performed. |
|
||||||
|
| ROLE-03 | ISTG-APP-AUTHZ-006 | Hierarchical Role Model Support | manual | Open | Test not yet performed. |
|
||||||
|
| ROLE-04 | ISTG-APP-AUTHZ-006 | User Account Deletion | manual | Open | Test not yet performed. |
|
||||||
|
| ROLE-05 | ISTG-APP-AUTHZ-006 | User Account Modification | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Privacy & Personal Data
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| PRIV-01 | ISTG-APP-PRIV-001 | User Notification of Personal Data Collection | manual | Open | Test not yet performed. |
|
||||||
|
| PRIV-02 | ISTG-APP-PRIV-002 | User Consent for Personal Data Usage | manual | Open | Test not yet performed. |
|
||||||
|
| PRIV-03 | ISTG-APP-PRIV-003 | Ability to Delete Personal Data | manual | Open | Test not yet performed. |
|
||||||
|
| PRIV-04 | ISTG-APP-PRIV-004 | Encryption of Personal Data in Storage/Transmission | Wireshark | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Telemetry
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| TELE-01 | ISTG-APP-PRIV-005 | Telemetry Data Collection | Wireshark | Open | Test not yet performed. |
|
||||||
|
| TELE-02 | ISTG-APP-PRIV-006 | Telemetry Transparency to User | manual | Open | Test not yet performed. |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Stability & Resilience
|
||||||
|
|
||||||
|
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||||||
|
|--------|---------------|------|------|--------|--------|
|
||||||
|
| STAB-01 | ISTG-SYS-REL-001 | Device Behavior After Power Failure | manual | Open | Test not yet performed. |
|
||||||
|
| STAB-02 | ISTG-SYS-REL-002 | Device Behavior After Network Failure | manual | Open | Test not yet performed. |
|
||||||
|
| STAB-03 | ISTG-SYS-REL-003 | Device Reconnection After Network Failure | manual | Open | Test not yet performed. |
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,97 @@
|
|||||||
|
# Bridge Firmware Analysis — `firmware.bin`
|
||||||
|
|
||||||
|
Static analysis of the LOQED bridge firmware dump (`firmware/bridge/firmware.bin`,
|
||||||
|
4 MB, MD5 `847d4795ee64714d3b02e2bdb3d20266`).
|
||||||
|
|
||||||
|
**Method:** analyzed with local **Binwalk + `strings`/`dd` + a partition-table parser** (the
|
||||||
|
same tools REA's firmware route wraps — the REA MCP server was not registered in that session).
|
||||||
|
All findings are **static** (nothing was executed). Offsets below are byte offsets into
|
||||||
|
`firmware.bin`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Identity & build
|
||||||
|
|
||||||
|
- Project **`LoqedBridge`**, ESP-IDF **v4.4.1**, ESP32-D0WD (single-core) + 64 Mbit PSRAM.
|
||||||
|
- Git commit baked in: **`33beadfc1ba5d4d3b0cb6a6ee673535a1d12972c`**, version `33beadf-dirty`.
|
||||||
|
The **`-dirty`** suffix means it was built from an **uncommitted working tree**.
|
||||||
|
- The 4 MB image is essentially **two copies of the same app** (factory @ `0x20000` and
|
||||||
|
ota_0 @ `0x160000`), which is why every string appears twice (e.g. CA store at `0x372fa`
|
||||||
|
and `0x166b55`).
|
||||||
|
|
||||||
|
## Flash layout (partition table @ `0x8000`)
|
||||||
|
|
||||||
|
| Label | Type | Subtype | Offset | Size |
|
||||||
|
| --- | --- | --- | --- | --- |
|
||||||
|
| `nvs` | data | 0x02 | `0x009000` | 16K |
|
||||||
|
| `nvs_key` | data | **0x04** | `0x00d000` | 4K |
|
||||||
|
| `otadata` | data | 0x00 | `0x00e000` | 8K |
|
||||||
|
| `phy_init` | data | 0x01 | `0x010000` | 4K |
|
||||||
|
| `factory` | app | 0x00 | `0x020000` | 1280K |
|
||||||
|
| `ota_0` | app | 0x10 | `0x160000` | 1280K |
|
||||||
|
| `ota_1` | app | 0x11 | `0x2a0000` | 1280K |
|
||||||
|
| `coredump` | data | 0x03 | `0x3e0000` | 64K |
|
||||||
|
|
||||||
|
The **`nvs_key`** partition (subtype 0x04) means NVS encryption is provisioned — consistent with
|
||||||
|
the boot log's `secure_boot_v1`.
|
||||||
|
|
||||||
|
## Keys & crypto — correcting an earlier finding
|
||||||
|
|
||||||
|
- **No plaintext keys or certificates are embedded.** The `report.txt` claim of "embedded RSA and
|
||||||
|
EC Private Key structural markers" is a **false positive**: the PEM lines at `0x39439+` are
|
||||||
|
mbedtls's null-terminated *label table* (contiguous `-----BEGIN/END ...-----\0` strings preceded
|
||||||
|
by ASN.1 OID bytes `2a 86 48 86 f7 0d 01 05 0d`), i.e. library format constants — not a key body.
|
||||||
|
- What *is* bundled: the **standard ESP/mbedtls CA trust store** (Entrust, XRamp, Trustwave,
|
||||||
|
Starfield, COMODO, Certum, Actalis, China Financial…). These are **public CA certs for TLS
|
||||||
|
server validation**, not secrets.
|
||||||
|
- Crypto primitives referenced: mbedtls with SHA-1/SHA-256 (Binwalk flagged SHA256 constants at
|
||||||
|
`0x2801c` / `0x167fc4`), AES, RSA, EC; TLS-PSK code paths exist (gated behind menuconfig).
|
||||||
|
- **Real device secrets** (device identity, auth/key tokens, WiFi credentials) live in the
|
||||||
|
encrypted `nvs` / `nvs_key` partitions, **not** in the code image.
|
||||||
|
- ⚠️ **Security observation:** the firmware logs credentials in cleartext to the UART console —
|
||||||
|
format strings `id: %llu, token: %s, auth_token: %s`, `key token: %s`, `token: %s`, and
|
||||||
|
`Setting wifi credentials to:`. Anyone with UART access could harvest live tokens at runtime.
|
||||||
|
|
||||||
|
## Endpoints (string literals)
|
||||||
|
|
||||||
|
- `mqtts://mqtt.production.loqed.com:8883` and `mqtts://production.loqed.com:8883` (MQTT/TLS)
|
||||||
|
- `https://gateway.production.loqed.com:443`, `https://production.loqed.com:8080`
|
||||||
|
- OTA: `https://firmware.loqed.com/firmware_bridge_…` and `…/firmware_lock_…`
|
||||||
|
- Core-dump exfil: `https://app.loqed.com/Bridge-core-dump/bridge-core-dump2.php`
|
||||||
|
(uploads crash core dumps to LOQED as multipart, with `"attachment"` / `"message"` fields)
|
||||||
|
|
||||||
|
## Functionality
|
||||||
|
|
||||||
|
- **Role:** the bridge is the **BLE central/client** — full of `esp_ble_gattc_*` (scan, open,
|
||||||
|
search_service, read/write char, register_for_notify, MTU). The lock is the BLE peripheral.
|
||||||
|
Pairing/bonding via `ESP_GAP_BLE_AUTH_CMPL_EVT`.
|
||||||
|
- **Cloud transport:** MQTT/TLS. Topic fragments: `locks/`, `/to_backend`, `/to_lock`, `/state`,
|
||||||
|
`/status` → structure is effectively `locks/<id>/to_lock` and `locks/<id>/to_backend`.
|
||||||
|
MQTT auth errors handled ("bad username or password", "not authorized").
|
||||||
|
- **Command protocol** (bridge relays Backend ↔ Lock):
|
||||||
|
- `Backend->Bridge: REQUEST_STATUS_INFO_BRIDGE`
|
||||||
|
- `Backend->Bridge: COMMAND_BRIDGE_FIRMWARE_UPGRADE` / `COMMAND_LOCK_FIRMWARE_UPGRADE`
|
||||||
|
- `COMMAND_ELECTRONIC_DOOR` / `COMMAND_ELECTRONIC_DOOR_REBOOT` (the actual door actuation)
|
||||||
|
- `Lock->Bridge: REQUEST_TIME_FROM_BRIDGE`, `RESPONSE_START_NEW_FIRMWARE_DOWNLOAD`,
|
||||||
|
`RESPONSE_SEND_PART_FIRMWARE` → the bridge downloads lock firmware over HTTPS and streams it
|
||||||
|
to the lock over BLE **in parts**.
|
||||||
|
- Payloads are **binary/custom**, not JSON (only the core-dump HTTP upload uses JSON keys).
|
||||||
|
- **Lock state machine** (`GO_TO_STATE_*`): `TWIST_ASSIST_{OPEN,LOCK,LATCH}`,
|
||||||
|
`INSTANTOPEN_{OPEN,LATCH}`, `TOUCH_TO_LOCK`, `MANUAL_{LOCK,UNLOCK}_{BLE,REMOTE}_{OPEN,LATCH,NIGHT_LOCK}`,
|
||||||
|
`MANUAL_UNLOCK_VIA_OUTSIDE_MODULE_{BUTTON,PIN}`; status/errors
|
||||||
|
`STATE_CHANGED_{OPEN,LATCH,NIGHT_LOCK,UNKNOWN}`, `MOTOR_STALL`. The three positions are
|
||||||
|
**open / latch / night-lock**, reachable via twist-assist, touch, outside PIN/button, BLE, or remote.
|
||||||
|
- **OTA:** HTTPS OTA (`esp_https_ota_*`) with A/B `ota_0`/`ota_1` + rollback, validates image
|
||||||
|
magic `0xE9`, for *both* bridge and lock.
|
||||||
|
- **WiFi provisioning:** `ap.authmode` / `ap.passwd`, "Set WiFi credentials (4)" — provisioned
|
||||||
|
(likely over BLE) and stored in NVS.
|
||||||
|
- Developer path leak persists: `/home/pierre/bridge/components/button_driver/iot_button.c`
|
||||||
|
and `/root/bridge/...`.
|
||||||
|
|
||||||
|
## Coverage & limits
|
||||||
|
|
||||||
|
- Static strings/structure only; **encrypted NVS contents (the actual secrets) were not
|
||||||
|
decrypted** — that needs the device's flash-encryption key, which is not in this image.
|
||||||
|
- Payload *semantics* (byte layout of the BLE/MQTT commands) are not recoverable from strings
|
||||||
|
alone — that needs disassembly of the Xtensa code (Ghidra/IDA) around the command-handler
|
||||||
|
functions.
|
||||||
Binary file not shown.
File diff suppressed because it is too large
Load Diff
Binary file not shown.
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,453 @@
|
|||||||
|
└─$ cat /dev/ttyUSB0 | tee frames.bin | xxd
|
||||||
|
00000000: ffff ff41 0809 4d48 8fcc 00ff ffff 410a ...A..MH......A.
|
||||||
|
00000010: 0ad5 7f12 4d0c 0000 2054 6f75 6368 2074 ....M... Touch t
|
||||||
|
00000020: 6f20 ffff ff41 0a0b fb24 d7b7 0c01 0120 o ...A...$.....
|
||||||
|
00000030: 2020 4c6f 636b 2020 20ff ffff 4108 094d Lock ...A..M
|
||||||
|
00000040: 488f cc00 ffff ff41 0a0a d57f 124d 0c00 H......A.....M..
|
||||||
|
00000050: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00000060: 0bfb 24d7 b70c 0101 2020 204c 6f63 6b20 ..$..... Lock
|
||||||
|
00000070: 2020 ffff 0000 002a 00ff ffff 4101 0002 .....*....A...
|
||||||
|
00000080: 3d89 3200 ffff ff41 0100 023d 8932 00ff =.2....A...=.2..
|
||||||
|
00000090: ffff 4101 0002 3d89 3200 ffff ff41 0100 ..A...=.2....A..
|
||||||
|
000000a0: 023d 8932 00ff ffff 4101 0002 3d89 3200 .=.2....A...=.2.
|
||||||
|
000000b0: ffff ff41 0100 023d 8932 00ff ffff 4101 ...A...=.2....A.
|
||||||
|
000000c0: 0002 3d89 3200 00ff ffff 4108 018d 23cf ..=.2.....A...#.
|
||||||
|
000000d0: 1500 ffff ff41 0a02 a1ba 2855 0c00 0020 .....A....(U...
|
||||||
|
000000e0: 546f 7563 6820 746f 20ff ffff 410a 038f Touch to ...A...
|
||||||
|
000000f0: e1ed af0c 0101 2020 204c 6f63 6b20 2020 ...... Lock
|
||||||
|
00000100: ffff ff41 0801 8d23 cf15 00ff ffff 410a ...A...#......A.
|
||||||
|
00000110: 02a1 ba28 550c 0000 2054 6f75 6368 2074 ...(U... Touch t
|
||||||
|
00000120: 6f20 ffff ff41 0a03 8fe1 edaf 0c01 0120 o ...A.........
|
||||||
|
00000130: 2020 4c6f 636b 2020 20ff ffff 4108 018d Lock ...A...
|
||||||
|
00000140: 23cf 1500 ffff ff41 0a02 a1ba 2855 0c00 #......A....(U..
|
||||||
|
00000150: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00000160: 038f e1ed af0c 0101 2020 204c 6f63 6b20 ........ Lock
|
||||||
|
00000170: 2020 ffff ff41 0801 8d23 cf15 00ff ffff ...A...#......
|
||||||
|
00000180: 410a 02a1 ba28 550c 0000 2054 6f75 6368 A....(U... Touch
|
||||||
|
00000190: 2074 6f20 ffff ff41 0a03 8fe1 edaf 0c01 to ...A........
|
||||||
|
000001a0: 0120 2020 4c6f 636b 2020 20ff ffff 4108 . Lock ...A.
|
||||||
|
000001b0: 018d 23cf 1500 ffff ff41 0a02 a1ba 2855 ..#......A....(U
|
||||||
|
000001c0: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
000001d0: 410a 038f e1ed af0c 0101 2020 204c 6f63 A......... Loc
|
||||||
|
000001e0: 6b20 2020 ffff ff41 0804 151b 4762 00ff k ...A....Gb..
|
||||||
|
000001f0: ffff 410a 0533 bf5c de0c 0000 2054 6f75 ..A..3.\.... Tou
|
||||||
|
00000200: 6368 2074 6f20 ffff ff41 0a06 4055 9722 ch to ...A..@U."
|
||||||
|
00000210: 0c01 0120 2020 4c6f 636b 2020 20ff ffff ... Lock ...
|
||||||
|
00000220: 4108 018d 23cf 1500 ffff ff41 0a02 a1ba A...#......A....
|
||||||
|
00000230: 2855 0c00 0020 546f 7563 6820 746f 20ff (U... Touch to .
|
||||||
|
00000240: ffff 410a 038f e1ed af0c 0101 2020 204c ..A......... L
|
||||||
|
00000250: 6f63 6b20 2020 ffff ff41 0804 151b 4762 ock ...A....Gb
|
||||||
|
00000260: 00ff ffff 410a 0533 bf5c de0c 0000 2054 ....A..3.\.... T
|
||||||
|
00000270: 6f75 6368 2074 6f20 ffff ff41 0801 8d23 ouch to ...A...#
|
||||||
|
00000280: cf15 00ff ffff 410a 02a1 ba28 550c 0000 ......A....(U...
|
||||||
|
00000290: 2054 6f75 6368 2074 6f20 ffff ff41 0a03 Touch to ...A..
|
||||||
|
000002a0: 8fe1 edaf 0c01 0120 2020 4c6f 636b 2020 ....... Lock
|
||||||
|
000002b0: 20ff ffff 4108 0415 1b47 6200 ffff ff41 ...A....Gb....A
|
||||||
|
000002c0: 0a05 33bf 5cde 0c00 0020 546f 7563 6820 ..3.\.... Touch
|
||||||
|
000002d0: 746f 20ff ffff 4108 0415 1b47 6200 ffff to ...A....Gb...
|
||||||
|
000002e0: ff41 0a05 33bf 5cde 0c00 0020 546f 7563 .A..3.\.... Touc
|
||||||
|
000002f0: 6820 746f 20ff ffff 4108 079d 0c3f 4f00 h to ...A....?O.
|
||||||
|
00000300: ffff ff41 0a08 88ce 1c4b 0c00 0020 546f ...A.....K... To
|
||||||
|
00000310: 7563 6820 746f 20ff ffff 410a 09a6 95d9 uch to ...A.....
|
||||||
|
00000320: b10c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00000330: ff41 0807 9d0c 3f4f 00ff ffff 410a 0888 .A....?O....A...
|
||||||
|
00000340: ce1c 4b0c 0000 2054 6f75 6368 2074 6f20 ..K... Touch to
|
||||||
|
00000350: ffff ff41 0a09 a695 d9b1 0c01 0120 2020 ...A.........
|
||||||
|
00000360: 4c6f 636b 2020 20ff ffff 4108 0415 1b47 Lock ...A....G
|
||||||
|
00000370: 6200 ffff ff41 0a05 33bf 5cde 0c00 0020 b....A..3.\....
|
||||||
|
00000380: 546f 7563 6820 746f 20ff ffff 4108 079d Touch to ...A...
|
||||||
|
00000390: 0c3f 4f00 ffff ff41 0a08 88ce 1c4b 0c00 .?O....A.....K..
|
||||||
|
000003a0: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
000003b0: 09a6 95d9 b10c 0101 2020 204c 6f63 6b20 ........ Lock
|
||||||
|
000003c0: 2020 ffff ff41 0804 151b 4762 00ff ffff ...A....Gb....
|
||||||
|
000003d0: 410a 0533 bf5c de0c 0000 2054 6f75 6368 A..3.\.... Touch
|
||||||
|
000003e0: 2074 6f20 ffff ff41 080a c55f f7e1 00ff to ...A..._....
|
||||||
|
000003f0: ffff 410a 0ba0 a975 cc0c 0000 2054 6f75 ..A....u.... Tou
|
||||||
|
00000400: 6368 2074 6f20 ffff ff41 0a0c 6921 a33c ch to ...A..i!.<
|
||||||
|
00000410: 0c01 0120 2020 4c6f 636b 2020 20ff ffff ... Lock ...
|
||||||
|
00000420: 4108 079d 0c3f 4f00 ffff ff41 0a08 88ce A....?O....A....
|
||||||
|
00000430: 1c4b 0c00 0020 546f 7563 6820 746f 20ff .K... Touch to .
|
||||||
|
00000440: ffff 410a 09a6 95d9 b10c 0101 2020 204c ..A......... L
|
||||||
|
00000450: 6f63 6b20 2020 ffff ff41 0804 151b 4762 ock ...A....Gb
|
||||||
|
00000460: 00ff ffff 410a 0533 bf5c de0c 0000 2054 ....A..3.\.... T
|
||||||
|
00000470: 6f75 6368 2074 6f20 ffff ff41 0807 9d0c ouch to ...A....
|
||||||
|
00000480: 3f4f 00ff ffff 410a 0888 ce1c 4b0c 0000 ?O....A.....K...
|
||||||
|
00000490: 2054 6f75 6368 2074 6f20 ffff ff41 0a09 Touch to ...A..
|
||||||
|
000004a0: a695 d9b1 0c01 0120 2020 4c6f 636b 2020 ....... Lock
|
||||||
|
000004b0: 20ff ffff 4108 079d 0c3f 4f00 ffff ff41 ...A....?O....A
|
||||||
|
000004c0: 0a08 88ce 1c4b 0c00 0020 546f 7563 6820 .....K... Touch
|
||||||
|
000004d0: 746f 20ff ffff 410a 09a6 95d9 b10c 0101 to ...A.........
|
||||||
|
000004e0: 2020 204c 6f63 6b20 2020 ffff ff41 0807 Lock ...A..
|
||||||
|
000004f0: 9d0c 3f4f 00ff ffff 410a 0888 ce1c 4b0c ..?O....A.....K.
|
||||||
|
00000500: 0000 2054 6f75 6368 2074 6f20 ffff ff41 .. Touch to ...A
|
||||||
|
00000510: 0a09 a695 d9b1 0c01 0120 2020 4c6f 636b ......... Lock
|
||||||
|
00000520: 2020 20ff ffff 410a 0d47 7a66 c60c 0000 ...A..Gzf....
|
||||||
|
00000530: 2054 6f75 6368 2074 6f20 ffff ff41 0a0e Touch to ...A..
|
||||||
|
00000540: 3490 ad3a 0c01 0120 2020 4c6f 636b 2020 4..:... Lock
|
||||||
|
00000550: 20ff ffff 410a 0d47 7a66 c60c 0000 2054 ...A..Gzf.... T
|
||||||
|
00000560: 6f75 6368 2074 6f20 ffff ff41 0a0e 3490 ouch to ...A..4.
|
||||||
|
00000570: ad3a 0c01 0120 2020 4c6f 636b 2020 20ff .:... Lock .
|
||||||
|
00000580: ffff 410a 0d47 7a66 c60c 0000 2054 6f75 ..A..Gzf.... Tou
|
||||||
|
00000590: 6368 2074 6f20 ffff ff41 0a0e 3490 ad3a ch to ...A..4..:
|
||||||
|
000005a0: 0c01 0120 2020 4c6f 636b 2020 20ff ffff ... Lock ...
|
||||||
|
000005b0: 410a 0d47 7a66 c60c 0000 2054 6f75 6368 A..Gzf.... Touch
|
||||||
|
000005c0: 2074 6f20 ffff ff41 0a0e 3490 ad3a 0c01 to ...A..4..:..
|
||||||
|
000005d0: 0120 2020 4c6f 636b 2020 20ff ffff 410a . Lock ...A.
|
||||||
|
000005e0: 0d47 7a66 c60c 0000 2054 6f75 6368 2074 .Gzf.... Touch t
|
||||||
|
000005f0: 6f20 ffff ff41 0a0e 3490 ad3a 0c01 0120 o ...A..4..:...
|
||||||
|
00000600: 2020 4c6f 636b 2020 20ff ffff 410a 0d47 Lock ...A..G
|
||||||
|
00000610: 7a66 c60c 0000 2054 6f75 6368 2074 6f20 zf.... Touch to
|
||||||
|
00000620: ffff ff41 0a0e 3490 ad3a 0c01 0120 2020 ...A..4..:...
|
||||||
|
00000630: 4c6f 636b 2020 20ff ffff 410a 0d47 7a66 Lock ...A..Gzf
|
||||||
|
00000640: c60c 0000 2054 6f75 6368 2074 6f20 ffff .... Touch to ..
|
||||||
|
00000650: ff41 0a0e 3490 ad3a 0c01 0120 2020 4c6f .A..4..:... Lo
|
||||||
|
00000660: 636b 2020 20ff ffff 410a 0f1a cb68 c00c ck ...A....h..
|
||||||
|
00000670: 0000 2054 6f75 6368 2074 6f20 ffff ff41 .. Touch to ...A
|
||||||
|
00000680: 0a10 4f0c f118 0c01 0120 2020 4c6f 636b ..O...... Lock
|
||||||
|
00000690: 2020 20ff ffff 410a 0f1a cb68 c00c 0000 ...A....h....
|
||||||
|
000006a0: 2054 6f75 6368 2074 6f20 ffff ff41 0a10 Touch to ...A..
|
||||||
|
000006b0: 4f0c f118 0c01 0120 2020 4c6f 636b 2020 O...... Lock
|
||||||
|
000006c0: 20ff ffff 410a 0f1a cb68 c00c 0000 2054 ...A....h.... T
|
||||||
|
000006d0: 6f75 6368 2074 6f20 ffff ff41 0a10 4f0c ouch to ...A..O.
|
||||||
|
000006e0: f118 0c01 0120 2020 4c6f 636b 2020 20ff ..... Lock .
|
||||||
|
000006f0: ffff 410a 0f1a cb68 c00c 0000 2054 6f75 ..A....h.... Tou
|
||||||
|
00000700: 6368 2074 6f20 ffff ff41 0a10 4f0c f118 ch to ...A..O...
|
||||||
|
00000710: 0c01 0120 2020 4c6f 636b 2020 20ff ffff ... Lock ...
|
||||||
|
00000720: 410a 0f1a cb68 c00c 0000 2054 6f75 6368 A....h.... Touch
|
||||||
|
00000730: 2074 6f20 ffff ff41 0a10 4f0c f118 0c01 to ...A..O.....
|
||||||
|
00000740: 0120 2020 4c6f 636b 2020 20ff ffff 410a . Lock ...A.
|
||||||
|
00000750: 0f1a cb68 c00c 0000 2054 6f75 6368 2074 ...h.... Touch t
|
||||||
|
00000760: 6f20 ffff ff41 0a10 4f0c f118 0c01 0120 o ...A..O......
|
||||||
|
00000770: 2020 4c6f 636b 2020 20ff ffff 410a 0f1a Lock ...A...
|
||||||
|
00000780: cb68 c00c 0000 2054 6f75 6368 2074 6f20 .h.... Touch to
|
||||||
|
00000790: ffff ff41 0a10 4f0c f118 0c01 0120 2020 ...A..O......
|
||||||
|
000007a0: 4c6f 636b 2020 20ff ffff 4108 11ba e98e Lock ...A.....
|
||||||
|
000007b0: a300 ffff ff41 0811 bae9 8ea3 00ff ffff .....A..........
|
||||||
|
000007c0: 4108 11ba e98e a300 ffff ff41 0811 bae9 A..........A....
|
||||||
|
000007d0: 8ea3 00ff ffff 4108 11ba e98e a300 ffff ......A.........
|
||||||
|
000007e0: ff41 0811 bae9 8ea3 00ff ffff 4108 11ba .A..........A...
|
||||||
|
000007f0: e98e a300 00ff ffff 4108 1232 fef6 8e00 ........A..2....
|
||||||
|
00000800: ffff ff41 0a13 3ce6 3ae4 0c00 0020 546f ...A..<.:.... To
|
||||||
|
00000810: 7563 6820 746f 20ff ffff 410a 14f5 6eec uch to ...A...n.
|
||||||
|
00000820: 140c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00000830: ff41 0812 32fe f68e 00ff ffff 410a 133c .A..2.......A..<
|
||||||
|
00000840: e63a e40c 0000 2054 6f75 6368 2074 6f20 .:.... Touch to
|
||||||
|
00000850: ffff ff41 0a14 f56e ec14 0c01 0120 2020 ...A...n.....
|
||||||
|
00000860: 4c6f 636b 2020 20ff ffff 4108 1232 fef6 Lock ...A..2..
|
||||||
|
00000870: 8e00 ffff ff41 0a13 3ce6 3ae4 0c00 0020 .....A..<.:....
|
||||||
|
00000880: 546f 7563 6820 746f 20ff ffff 410a 14f5 Touch to ...A...
|
||||||
|
00000890: 6eec 140c 0101 2020 204c 6f63 6b20 2020 n..... Lock
|
||||||
|
000008a0: ffff ff41 0812 32fe f68e 00ff ffff 410a ...A..2.......A.
|
||||||
|
000008b0: 133c e63a e40c 0000 2054 6f75 6368 2074 .<.:.... Touch t
|
||||||
|
000008c0: 6f20 ffff ff41 0a14 f56e ec14 0c01 0120 o ...A...n.....
|
||||||
|
000008d0: 2020 4c6f 636b 2020 20ff ffff 4108 1232 Lock ...A..2
|
||||||
|
000008e0: fef6 8e00 ffff ff41 0a13 3ce6 3ae4 0c00 .......A..<.:...
|
||||||
|
000008f0: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00000900: 14f5 6eec 140c 0101 2020 204c 6f63 6b20 ..n..... Lock
|
||||||
|
00000910: 2020 ffff ff41 0812 32fe f68e 00ff ffff ...A..2.......
|
||||||
|
00000920: 410a 133c e63a e40c 0000 2054 6f75 6368 A..<.:.... Touch
|
||||||
|
00000930: 2074 6f20 ffff ff41 0a14 f56e ec14 0c01 to ...A...n....
|
||||||
|
00000940: 0120 2020 4c6f 636b 2020 20ff ffff 4108 . Lock ...A.
|
||||||
|
00000950: 1232 fef6 8e00 ffff ff41 0a13 3ce6 3ae4 .2.......A..<.:.
|
||||||
|
00000960: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
00000970: 410a 14f5 6eec 140c 0101 2020 204c 6f63 A...n..... Loc
|
||||||
|
00000980: 6b20 2020 ffff ff41 0a15 db35 29ee 0c00 k ...A...5)...
|
||||||
|
00000990: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
000009a0: 16a8 dfe2 120c 0101 2020 204c 6f63 6b20 ........ Lock
|
||||||
|
000009b0: 2020 ffff ff41 0a15 db35 29ee 0c00 0020 ...A...5)....
|
||||||
|
000009c0: 546f 7563 6820 746f 20ff ffff 410a 16a8 Touch to ...A...
|
||||||
|
000009d0: dfe2 120c 0101 2020 204c 6f63 6b20 2020 ...... Lock
|
||||||
|
000009e0: ffff ff41 0a15 db35 29ee 0c00 0020 546f ...A...5).... To
|
||||||
|
000009f0: 7563 6820 746f 20ff ffff 410a 16a8 dfe2 uch to ...A.....
|
||||||
|
00000a00: 120c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00000a10: ff41 0a15 db35 29ee 0c00 0020 546f 7563 .A...5).... Touc
|
||||||
|
00000a20: 6820 746f 20ff ffff 410a 16a8 dfe2 120c h to ...A.......
|
||||||
|
00000a30: 0101 2020 204c 6f63 6b20 2020 ffff ff41 .. Lock ...A
|
||||||
|
00000a40: 0a15 db35 29ee 0c00 0020 546f 7563 6820 ...5).... Touch
|
||||||
|
00000a50: 746f 20ff ffff 410a 16a8 dfe2 120c 0101 to ...A.........
|
||||||
|
00000a60: 2020 204c 6f63 6b20 2020 ffff ff41 0a15 Lock ...A..
|
||||||
|
00000a70: db35 29ee 0c00 0020 546f 7563 6820 746f .5).... Touch to
|
||||||
|
00000a80: 20ff ffff 410a 16a8 dfe2 120c 0101 2020 ...A.........
|
||||||
|
00000a90: 204c 6f63 6b20 2020 ffff ff41 0a15 db35 Lock ...A...5
|
||||||
|
00000aa0: 29ee 0c00 0020 546f 7563 6820 746f 20ff ).... Touch to .
|
||||||
|
00000ab0: ffff 410a 16a8 dfe2 120c 0101 2020 204c ..A......... L
|
||||||
|
00000ac0: 6f63 6b20 2020 ffff ff41 0a17 8684 27e8 ock ...A....'.
|
||||||
|
00000ad0: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
00000ae0: 410a 183b c9cb 000c 0101 2020 204c 6f63 A..;...... Loc
|
||||||
|
00000af0: 6b20 2020 ffff ff41 0a17 8684 27e8 0c00 k ...A....'...
|
||||||
|
00000b00: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00000b10: 183b c9cb 000c 0101 2020 204c 6f63 6b20 .;...... Lock
|
||||||
|
00000b20: 2020 ffff ff41 0a17 8684 27e8 0c00 0020 ...A....'....
|
||||||
|
00000b30: 546f 7563 6820 746f 20ff ffff 410a 183b Touch to ...A..;
|
||||||
|
00000b40: c9cb 000c 0101 2020 204c 6f63 6b20 2020 ...... Lock
|
||||||
|
00000b50: ffff ff41 0a17 8684 27e8 0c00 0020 546f ...A....'.... To
|
||||||
|
00000b60: 7563 6820 746f 20ff ffff 410a 183b c9cb uch to ...A..;..
|
||||||
|
00000b70: 000c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00000b80: ff41 0a17 8684 27e8 0c00 0020 546f 7563 .A....'.... Touc
|
||||||
|
00000b90: 6820 746f 20ff ffff 410a 183b c9cb 000c h to ...A..;....
|
||||||
|
00000ba0: 0101 2020 204c 6f63 6b20 2020 ffff ff41 .. Lock ...A
|
||||||
|
00000bb0: 0a17 8684 27e8 0c00 0020 546f 7563 6820 ....'.... Touch
|
||||||
|
00000bc0: 746f 20ff ffff 410a 183b c9cb 000c 0101 to ...A..;......
|
||||||
|
00000bd0: 2020 204c 6f63 6b20 2020 ffff ff41 0a17 Lock ...A..
|
||||||
|
00000be0: 8684 27e8 0c00 0020 546f 7563 6820 746f ..'.... Touch to
|
||||||
|
00000bf0: 20ff ffff 410a 183b c9cb 000c 0101 2020 ...A..;......
|
||||||
|
00000c00: 204c 6f63 6b20 2020 ffff ff41 0819 7a82 Lock ...A..z.
|
||||||
|
00000c10: ce7a 00ff ffff 4108 197a 82ce 7a00 ffff .z....A..z..z...
|
||||||
|
00000c20: ff41 0819 7a82 ce7a 00ff ffff 4108 197a .A..z..z....A..z
|
||||||
|
00000c30: 82ce 7a00 ffff ff41 0819 7a82 ce7a 00ff ..z....A..z..z..
|
||||||
|
00000c40: ffff 4108 197a 82ce 7a00 ffff ff41 0819 ..A..z..z....A..
|
||||||
|
00000c50: 7a82 ce7a 0000 ffff ff41 081a f295 b657 z..z.....A.....W
|
||||||
|
00000c60: 00ff ffff 410a 1b48 2300 fc0c 0000 2054 ....A..H#..... T
|
||||||
|
00000c70: 6f75 6368 2074 6f20 ffff ff41 0a1c 81ab ouch to ...A....
|
||||||
|
00000c80: d60c 0c01 0120 2020 4c6f 636b 2020 20ff ..... Lock .
|
||||||
|
00000c90: ffff 4108 1af2 95b6 5700 ffff ff41 0a1b ..A.....W....A..
|
||||||
|
00000ca0: 4823 00fc 0c00 0020 546f 7563 6820 746f H#..... Touch to
|
||||||
|
00000cb0: 20ff ffff 410a 1c81 abd6 0c0c 0101 2020 ...A.........
|
||||||
|
00000cc0: 204c 6f63 6b20 2020 ffff ff41 081a f295 Lock ...A....
|
||||||
|
00000cd0: b657 00ff ffff 410a 1b48 2300 fc0c 0000 .W....A..H#.....
|
||||||
|
00000ce0: 2054 6f75 6368 2074 6f20 ffff ff41 0a1c Touch to ...A..
|
||||||
|
00000cf0: 81ab d60c 0c01 0120 2020 4c6f 636b 2020 ....... Lock
|
||||||
|
00000d00: 20ff ffff 4108 1d9a b76e 1600 ffff ff41 ...A....n.....A
|
||||||
|
00000d10: 0a1e 8797 7a71 0c00 0020 546f 7563 6820 ....zq... Touch
|
||||||
|
00000d20: 746f 20ff ffff 410a 1fa9 ccbf 8b0c 0101 to ...A.........
|
||||||
|
00000d30: 2020 204c 6f63 6b20 2020 ffff ff41 081a Lock ...A..
|
||||||
|
00000d40: f295 b657 00ff ffff 410a 1b48 2300 fc0c ...W....A..H#...
|
||||||
|
00000d50: 0000 2054 6f75 6368 2074 6f20 ffff ff41 .. Touch to ...A
|
||||||
|
00000d60: 0a1c 81ab d60c 0c01 0120 2020 4c6f 636b ......... Lock
|
||||||
|
00000d70: 2020 20ff ffff 4108 1d9a b76e 1600 ffff ...A....n....
|
||||||
|
00000d80: ff41 0a1e 8797 7a71 0c00 0020 546f 7563 .A....zq... Touc
|
||||||
|
00000d90: 6820 746f 20ff ffff 4108 1af2 95b6 5700 h to ...A.....W.
|
||||||
|
00000da0: ffff ff41 0a1b 4823 00fc 0c00 0020 546f ...A..H#..... To
|
||||||
|
00000db0: 7563 6820 746f 20ff ffff 410a 1c81 abd6 uch to ...A.....
|
||||||
|
00000dc0: 0c0c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00000dd0: ff41 081d 9ab7 6e16 00ff ffff 410a 1e87 .A....n.....A...
|
||||||
|
00000de0: 977a 710c 0000 2054 6f75 6368 2074 6f20 .zq... Touch to
|
||||||
|
00000df0: ffff ff41 081a f295 b657 00ff ffff 410a ...A.....W....A.
|
||||||
|
00000e00: 1b48 2300 fc0c 0000 2054 6f75 6368 2074 .H#..... Touch t
|
||||||
|
00000e10: 6f20 ffff ff41 0a1c 81ab d60c 0c01 0120 o ...A.........
|
||||||
|
00000e20: 2020 4c6f 636b 2020 20ff ffff 4108 1d9a Lock ...A...
|
||||||
|
00000e30: b76e 1600 ffff ff41 0a1e 8797 7a71 0c00 .n.....A....zq..
|
||||||
|
00000e40: 0020 546f 7563 6820 746f 20ff ffff 4108 . Touch to ...A.
|
||||||
|
00000e50: 1af2 95b6 5700 ffff ff41 0a1b 4823 00fc ....W....A..H#..
|
||||||
|
00000e60: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
00000e70: 410a 1c81 abd6 0c0c 0101 2020 204c 6f63 A......... Loc
|
||||||
|
00000e80: 6b20 2020 ffff ff41 081d 9ab7 6e16 00ff k ...A....n...
|
||||||
|
00000e90: ffff 410a 1e87 977a 710c 0000 2054 6f75 ..A....zq... Tou
|
||||||
|
00000ea0: 6368 2074 6f20 ffff ff41 081d 9ab7 6e16 ch to ...A....n.
|
||||||
|
00000eb0: 00ff ffff 410a 1e87 977a 710c 0000 2054 ....A....zq... T
|
||||||
|
00000ec0: 6f75 6368 2074 6f20 ffff ff41 081d 9ab7 ouch to ...A....
|
||||||
|
00000ed0: 6e16 00ff ffff 410a 1e87 977a 710c 0000 n.....A....zq...
|
||||||
|
00000ee0: 2054 6f75 6368 2074 6f20 ffff ff41 0a20 Touch to ...A.
|
||||||
|
00000ef0: 2c1e cd33 0c00 0020 546f 7563 6820 746f ,..3... Touch to
|
||||||
|
00000f00: 20ff ffff 410a 2102 4508 c90c 0101 2020 ...A.!.E.....
|
||||||
|
00000f10: 204c 6f63 6b20 2020 ffff ff41 0a20 2c1e Lock ...A. ,.
|
||||||
|
00000f20: cd33 0c00 0020 546f 7563 6820 746f 20ff .3... Touch to .
|
||||||
|
00000f30: ffff 410a 2102 4508 c90c 0101 2020 204c ..A.!.E..... L
|
||||||
|
00000f40: 6f63 6b20 2020 ffff ff41 0a20 2c1e cd33 ock ...A. ,..3
|
||||||
|
00000f50: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
00000f60: 410a 2102 4508 c90c 0101 2020 204c 6f63 A.!.E..... Loc
|
||||||
|
00000f70: 6b20 2020 ffff ff41 0a20 2c1e cd33 0c00 k ...A. ,..3..
|
||||||
|
00000f80: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00000f90: 2102 4508 c90c 0101 2020 204c 6f63 6b20 !.E..... Lock
|
||||||
|
00000fa0: 2020 ffff ff41 0a20 2c1e cd33 0c00 0020 ...A. ,..3...
|
||||||
|
00000fb0: 546f 7563 6820 746f 20ff ffff 410a 2102 Touch to ...A.!.
|
||||||
|
00000fc0: 4508 c90c 0101 2020 204c 6f63 6b20 2020 E..... Lock
|
||||||
|
00000fd0: ffff ff41 0a20 2c1e cd33 0c00 0020 546f ...A. ,..3... To
|
||||||
|
00000fe0: 7563 6820 746f 20ff ffff 410a 2102 4508 uch to ...A.!.E.
|
||||||
|
00000ff0: c90c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00001000: ff41 0a20 2c1e cd33 0c00 0020 546f 7563 .A. ,..3... Touc
|
||||||
|
00001010: 6820 746f 20ff ffff 410a 2102 4508 c90c h to ...A.!.E...
|
||||||
|
00001020: 0101 2020 204c 6f63 6b20 2020 ffff ff41 .. Lock ...A
|
||||||
|
00001030: 0a22 71af c335 0c00 0020 546f 7563 6820 ."q..5... Touch
|
||||||
|
00001040: 746f 20ff ffff 410a 235f f406 cf0c 0101 to ...A.#_......
|
||||||
|
00001050: 2020 204c 6f63 6b20 2020 ffff ff41 0a22 Lock ...A."
|
||||||
|
00001060: 71af c335 0c00 0020 546f 7563 6820 746f q..5... Touch to
|
||||||
|
00001070: 20ff ffff 410a 235f f406 cf0c 0101 2020 ...A.#_......
|
||||||
|
00001080: 204c 6f63 6b20 2020 ffff ff41 0a22 71af Lock ...A."q.
|
||||||
|
00001090: c335 0c00 0020 546f 7563 6820 746f 20ff .5... Touch to .
|
||||||
|
000010a0: ffff 410a 235f f406 cf0c 0101 2020 204c ..A.#_...... L
|
||||||
|
000010b0: 6f63 6b20 2020 ffff ff41 0a22 71af c335 ock ...A."q..5
|
||||||
|
000010c0: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
000010d0: 410a 235f f406 cf0c 0101 2020 204c 6f63 A.#_...... Loc
|
||||||
|
000010e0: 6b20 2020 ffff ff41 0a22 71af c335 0c00 k ...A."q..5..
|
||||||
|
000010f0: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00001100: 235f f406 cf0c 0101 2020 204c 6f63 6b20 #_...... Lock
|
||||||
|
00001110: 2020 ffff ff41 0a22 71af c335 0c00 0020 ...A."q..5...
|
||||||
|
00001120: 546f 7563 6820 746f 20ff ffff 410a 235f Touch to ...A.#_
|
||||||
|
00001130: f406 cf0c 0101 2020 204c 6f63 6b20 2020 ...... Lock
|
||||||
|
00001140: ffff ff41 0a22 71af c335 0c00 0020 546f ...A."q..5... To
|
||||||
|
00001150: 7563 6820 746f 20ff ffff 410a 235f f406 uch to ...A.#_..
|
||||||
|
00001160: cf0c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00001170: ff41 0824 cc92 050a 00ff ffff 4108 24cc .A.$........A.$.
|
||||||
|
00001180: 9205 0a00 ffff ff41 0824 cc92 050a 00ff .......A.$......
|
||||||
|
00001190: ffff 4108 24cc 9205 0a00 ffff ff41 0824 ..A.$........A.$
|
||||||
|
000011a0: cc92 050a 00ff ffff 4108 24cc 9205 0a00 ........A.$.....
|
||||||
|
000011b0: ffff ff41 0824 cc92 050a 00ff ffff 4108 ...A.$........A.
|
||||||
|
000011c0: 25b4 9f2d 1100 ffff ff41 0a26 cbcd de39 %..-.....A.&...9
|
||||||
|
000011d0: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
000011e0: 410a 27e5 961b c30c 0101 2020 204c 6f63 A.'....... Loc
|
||||||
|
000011f0: 6b20 2020 ffff ff41 0825 b49f 2d11 00ff k ...A.%..-...
|
||||||
|
00001200: ffff 410a 26cb cdde 390c 0000 2054 6f75 ..A.&...9... Tou
|
||||||
|
00001210: 6368 2074 6f20 ffff ff41 0a27 e596 1bc3 ch to ...A.'....
|
||||||
|
00001220: 0c01 0120 2020 4c6f 636b 2020 20ff ffff ... Lock ...
|
||||||
|
00001230: 4108 25b4 9f2d 1100 ffff ff41 0a26 cbcd A.%..-.....A.&..
|
||||||
|
00001240: de39 0c00 0020 546f 7563 6820 746f 20ff .9... Touch to .
|
||||||
|
00001250: ffff 410a 27e5 961b c30c 0101 2020 204c ..A.'....... L
|
||||||
|
00001260: 6f63 6b20 2020 ffff ff41 0825 b49f 2d11 ock ...A.%..-.
|
||||||
|
00001270: 00ff ffff 410a 26cb cdde 390c 0000 2054 ....A.&...9... T
|
||||||
|
00001280: 6f75 6368 2074 6f20 ffff ff41 0a27 e596 ouch to ...A.'..
|
||||||
|
00001290: 1bc3 0c01 0120 2020 4c6f 636b 2020 20ff ..... Lock .
|
||||||
|
000012a0: ffff 4108 25b4 9f2d 1100 ffff ff41 0a26 ..A.%..-.....A.&
|
||||||
|
000012b0: cbcd de39 0c00 0020 546f 7563 6820 746f ...9... Touch to
|
||||||
|
000012c0: 20ff ffff 410a 27e5 961b c30c 0101 2020 ...A.'.......
|
||||||
|
000012d0: 204c 6f63 6b20 2020 ffff ff41 0825 b49f Lock ...A.%..
|
||||||
|
000012e0: 2d11 00ff ffff 410a 26cb cdde 390c 0000 -.....A.&...9...
|
||||||
|
000012f0: 2054 6f75 6368 2074 6f20 ffff ff41 0a27 Touch to ...A.'
|
||||||
|
00001300: e596 1bc3 0c01 0120 2020 4c6f 636b 2020 ....... Lock
|
||||||
|
00001310: 20ff ffff 4108 25b4 9f2d 1100 ffff ff41 ...A.%..-.....A
|
||||||
|
00001320: 0a26 cbcd de39 0c00 0020 546f 7563 6820 .&...9... Touch
|
||||||
|
00001330: 746f 20ff ffff 410a 27e5 961b c30c 0101 to ...A.'.......
|
||||||
|
00001340: 2020 204c 6f63 6b20 2020 ffff ff41 0a28 Lock ...A.(
|
||||||
|
00001350: 58db f72b 0c00 0020 546f 7563 6820 746f X..+... Touch to
|
||||||
|
00001360: 20ff ffff 410a 2976 8032 d10c 0101 2020 ...A.)v.2....
|
||||||
|
00001370: 204c 6f63 6b20 2020 ffff ff41 0a28 58db Lock ...A.(X.
|
||||||
|
00001380: f72b 0c00 0020 546f 7563 6820 746f 20ff .+... Touch to .
|
||||||
|
00001390: ffff 410a 2976 8032 d10c 0101 2020 204c ..A.)v.2.... L
|
||||||
|
000013a0: 6f63 6b20 2020 ffff ff41 0a28 58db f72b ock ...A.(X..+
|
||||||
|
000013b0: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
000013c0: 410a 2976 8032 d10c 0101 2020 204c 6f63 A.)v.2.... Loc
|
||||||
|
000013d0: 6b20 2020 ffff ff41 0a28 58db f72b 0c00 k ...A.(X..+..
|
||||||
|
000013e0: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
000013f0: 2976 8032 d10c 0101 2020 204c 6f63 6b20 )v.2.... Lock
|
||||||
|
00001400: 2020 ffff ff41 0a28 58db f72b 0c00 0020 ...A.(X..+...
|
||||||
|
00001410: 546f 7563 6820 746f 20ff ffff 410a 2976 Touch to ...A.)v
|
||||||
|
00001420: 8032 d10c 0101 2020 204c 6f63 6b20 2020 .2.... Lock
|
||||||
|
00001430: ffff ff41 0a28 58db f72b 0c00 0020 546f ...A.(X..+... To
|
||||||
|
00001440: 7563 6820 746f 20ff ffff 410a 2976 8032 uch to ...A.)v.2
|
||||||
|
00001450: d10c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00001460: ff41 0a28 58db f72b 0c00 0020 546f 7563 .A.(X..+... Touc
|
||||||
|
00001470: 6820 746f 20ff ffff 410a 2976 8032 d10c h to ...A.)v.2..
|
||||||
|
00001480: 0101 2020 204c 6f63 6b20 2020 ffff ff41 .. Lock ...A
|
||||||
|
00001490: 0a2a 056a f92d 0c00 0020 546f 7563 6820 .*.j.-... Touch
|
||||||
|
000014a0: 746f 20ff ffff 410a 2b2b 313c d70c 0101 to ...A.++1<....
|
||||||
|
000014b0: 2020 204c 6f63 6b20 2020 ffff ff41 0a2a Lock ...A.*
|
||||||
|
000014c0: 056a f92d 0c00 0020 546f 7563 6820 746f .j.-... Touch to
|
||||||
|
000014d0: 20ff ffff 410a 2b2b 313c d70c 0101 2020 ...A.++1<....
|
||||||
|
000014e0: 204c 6f63 6b20 2020 ffff ff41 0a2a 056a Lock ...A.*.j
|
||||||
|
000014f0: f92d 0c00 0020 546f 7563 6820 746f 20ff .-... Touch to .
|
||||||
|
00001500: ffff 410a 2b2b 313c d70c 0101 2020 204c ..A.++1<.... L
|
||||||
|
00001510: 6f63 6b20 2020 ffff ff41 0a2a 056a f92d ock ...A.*.j.-
|
||||||
|
00001520: 0c00 0020 546f 7563 6820 746f 20ff ffff ... Touch to ...
|
||||||
|
00001530: 410a 2b2b 313c d70c 0101 2020 204c 6f63 A.++1<.... Loc
|
||||||
|
00001540: 6b20 2020 ffff ff41 0a2a 056a f92d 0c00 k ...A.*.j.-..
|
||||||
|
00001550: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00001560: 2b2b 313c d70c 0101 2020 204c 6f63 6b20 ++1<.... Lock
|
||||||
|
00001570: 2020 ffff ff41 0a2a 056a f92d 0c00 0020 ...A.*.j.-...
|
||||||
|
00001580: 546f 7563 6820 746f 20ff ffff 410a 2b2b Touch to ...A.++
|
||||||
|
00001590: 313c d70c 0101 2020 204c 6f63 6b20 2020 1<.... Lock
|
||||||
|
000015a0: ffff ff41 0a2a 056a f92d 0c00 0020 546f ...A.*.j.-... To
|
||||||
|
000015b0: 7563 6820 746f 20ff ffff 410a 2b2b 313c uch to ...A.++1<
|
||||||
|
000015c0: d70c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
000015d0: ff41 082c 0cf9 45d3 00ff ffff 4108 2c0c .A.,..E.....A.,.
|
||||||
|
000015e0: f945 d300 ffff ff41 082c 0cf9 45d3 00ff .E.....A.,..E...
|
||||||
|
000015f0: ffff 4108 2c0c f945 d300 ffff ff41 082c ..A.,..E.....A.,
|
||||||
|
00001600: 0cf9 45d3 00ff ffff 4108 2c0c f945 d300 ..E.....A.,..E..
|
||||||
|
00001610: ffff ff41 082c 0cf9 45d3 0000 ffff ff41 ...A.,..E......A
|
||||||
|
00001620: 082d 74f4 6dc8 00ff ffff 410a 2ebf 08e4 .-t.m.....A.....
|
||||||
|
00001630: 210c 0000 2054 6f75 6368 2074 6f20 ffff !... Touch to ..
|
||||||
|
00001640: ff41 0a2f 9153 21db 0c01 0120 2020 4c6f .A./.S!.... Lo
|
||||||
|
00001650: 636b 2020 20ff ffff 4108 2d74 f46d c800 ck ...A.-t.m..
|
||||||
|
00001660: ffff ff41 0a2e bf08 e421 0c00 0020 546f ...A.....!... To
|
||||||
|
00001670: 7563 6820 746f 20ff ffff 410a 2f91 5321 uch to ...A./.S!
|
||||||
|
00001680: db0c 0101 2020 204c 6f63 6b20 2020 ffff .... Lock ..
|
||||||
|
00001690: ff41 082d 74f4 6dc8 00ff ffff 410a 2ebf .A.-t.m.....A...
|
||||||
|
000016a0: 08e4 210c 0000 2054 6f75 6368 2074 6f20 ..!... Touch to
|
||||||
|
000016b0: ffff ff41 0a2f 9153 21db 0c01 0120 2020 ...A./.S!....
|
||||||
|
000016c0: 4c6f 636b 2020 20ff ffff 4108 2d74 f46d Lock ...A.-t.m
|
||||||
|
000016d0: c800 ffff ff41 0a2e bf08 e421 0c00 0020 .....A.....!...
|
||||||
|
000016e0: 546f 7563 6820 746f 20ff ffff 410a 2f91 Touch to ...A./.
|
||||||
|
000016f0: 5321 db0c 0101 2020 204c 6f63 6b20 2020 S!.... Lock
|
||||||
|
00001700: ffff ff41 082d 74f4 6dc8 00ff ffff 410a ...A.-t.m.....A.
|
||||||
|
00001710: 2ebf 08e4 210c 0000 2054 6f75 6368 2074 ....!... Touch t
|
||||||
|
00001720: 6f20 ffff ff41 0a2f 9153 21db 0c01 0120 o ...A./.S!....
|
||||||
|
00001730: 2020 4c6f 636b 2020 20ff ffff 4108 2d74 Lock ...A.-t
|
||||||
|
00001740: f46d c800 ffff ff41 0a2e bf08 e421 0c00 .m.....A.....!..
|
||||||
|
00001750: 0020 546f 7563 6820 746f 20ff ffff 410a . Touch to ...A.
|
||||||
|
00001760: 2f91 5321 db0c 0101 2020 204c 6f63 6b20 /.S!.... Lock
|
||||||
|
00001770: 2020 ffff ff41 082d 74f4 6dc8 00ff ffff ...A.-t.m.....
|
||||||
|
00001780: 410a 2ebf 08e4 210c 0000 2054 6f75 6368 A.....!... Touch
|
||||||
|
00001790: 2074 6f20 ffff ff41 0a2f 9153 21db 0c01 to ...A./.S!...
|
||||||
|
000017a0: 0120 2020 4c6f 636b 2020 20ff ffff 410a . Lock ...A.
|
||||||
|
000017b0: 30c4 94b8 030c 0000 2054 6f75 6368 2074 0....... Touch t
|
||||||
|
000017c0: 6f20 ffff ff41 0a31 eacf 7df9 0c01 0120 o ...A.1..}....
|
||||||
|
000017d0: 2020 4c6f 636b 2020 20ff ffff 410a 30c4 Lock ...A.0.
|
||||||
|
000017e0: 94b8 030c 0000 2054 6f75 6368 2074 6f20 ...... Touch to
|
||||||
|
000017f0: ffff ff41 0a31 eacf 7df9 0c01 0120 2020 ...A.1..}....
|
||||||
|
00001800: 4c6f 636b 2020 20ff ffff 410a 30c4 94b8 Lock ...A.0...
|
||||||
|
00001810: 030c 0000 2054 6f75 6368 2074 6f20 ffff .... Touch to ..
|
||||||
|
00001820: ff41 0a31 eacf 7df9 0c01 0120 2020 4c6f .A.1..}.... Lo
|
||||||
|
00001830: 636b 2020 20ff ffff 410a 30c4 94b8 030c ck ...A.0.....
|
||||||
|
00001840: 0000 2054 6f75 6368 2074 6f20 ffff ff41 .. Touch to ...A
|
||||||
|
00001850: 0a31 eacf 7df9 0c01 0120 2020 4c6f 636b .1..}.... Lock
|
||||||
|
00001860: 2020 20ff ffff 410a 30c4 94b8 030c 0000 ...A.0.......
|
||||||
|
00001870: 2054 6f75 6368 2074 6f20 ffff ff41 0a31 Touch to ...A.1
|
||||||
|
00001880: eacf 7df9 0c01 0120 2020 4c6f 636b 2020 ..}.... Lock
|
||||||
|
00001890: 20ff ffff 410a 30c4 94b8 030c 0000 2054 ...A.0....... T
|
||||||
|
000018a0: 6f75 6368 2074 6f20 ffff ff41 0a31 eacf ouch to ...A.1..
|
||||||
|
000018b0: 7df9 0c01 0120 2020 4c6f 636b 2020 20ff }.... Lock .
|
||||||
|
000018c0: ffff 410a 30c4 94b8 030c 0000 2054 6f75 ..A.0....... Tou
|
||||||
|
000018d0: 6368 2074 6f20 ffff ff41 0a31 eacf 7df9 ch to ...A.1..}.
|
||||||
|
000018e0: 0c01 0120 2020 4c6f 636b 2020 20ff ffff ... Lock ...
|
||||||
|
000018f0: 410a 3299 25b6 050c 0000 2054 6f75 6368 A.2.%..... Touch
|
||||||
|
00001900: 2074 6f20 ffff ff41 0a33 b77e 73ff 0c01 to ...A.3.~s...
|
||||||
|
00001910: 0120 2020 4c6f 636b 2020 20ff ffff 410a . Lock ...A.
|
||||||
|
00001920: 3299 25b6 050c 0000 2054 6f75 6368 2074 2.%..... Touch t
|
||||||
|
00001930: 6f20 ffff ff41 0a33 b77e 73ff 0c01 0120 o ...A.3.~s....
|
||||||
|
00001940: 2020 4c6f 636b 2020 20ff ffff 410a 3299 Lock ...A.2.
|
||||||
|
00001950: 25b6 050c 0000 2054 6f75 6368 2074 6f20 %..... Touch to
|
||||||
|
00001960: ffff ff41 0a33 b77e 73ff 0c01 0120 2020 ...A.3.~s....
|
||||||
|
00001970: 4c6f 636b 2020 20ff ffff 410a 3299 25b6 Lock ...A.2.%.
|
||||||
|
00001980: 050c 0000 2054 6f75 6368 2074 6f20 ffff .... Touch to ..
|
||||||
|
00001990: ff41 0a33 b77e 73ff 0c01 0120 2020 4c6f .A.3.~s.... Lo
|
||||||
|
000019a0: 636b 2020 20ff ffff 410a 3299 25b6 050c ck ...A.2.%...
|
||||||
|
000019b0: 0000 2054 6f75 6368 2074 6f20 ffff ff41 .. Touch to ...A
|
||||||
|
000019c0: 0a33 b77e 73ff 0c01 0120 2020 4c6f 636b .3.~s.... Lock
|
||||||
|
000019d0: 2020 20ff ffff 410a 3299 25b6 050c 0000 ...A.2.%.....
|
||||||
|
000019e0: 2054 6f75 6368 2074 6f20 ffff ff41 0a33 Touch to ...A.3
|
||||||
|
000019f0: b77e 73ff 0c01 0120 2020 4c6f 636b 2020 .~s.... Lock
|
||||||
|
00001a00: 20ff ffff 410a 3299 25b6 050c 0000 2054 ...A.2.%..... T
|
||||||
|
00001a10: 6f75 6368 2074 6f20 ffff ff41 0a33 b77e ouch to ...A.3.~
|
||||||
|
00001a20: 73ff 0c01 0120 2020 4c6f 636b 2020 20ff s.... Lock .
|
||||||
|
00001a30: ffff 4108 34fb 5844 bc00 ffff ff41 0834 ..A.4.XD.....A.4
|
||||||
|
00001a40: fb58 44bc 00ff ffff 4108 34fb 5844 bc00 .XD.....A.4.XD..
|
||||||
|
00001a50: ffff ff41 0834 fb58 44bc 00ff ffff 4108 ...A.4.XD.....A.
|
||||||
|
00001a60: 34fb 5844 bc00 ffff ff41 0834 fb58 44bc 4.XD.....A.4.XD.
|
||||||
|
00001a70: 00ff ffff 4108 34fb 5844 bc00 00ff ffff ....A.4.XD......
|
||||||
|
00001a80: 4108 3583 556c a700 ffff ff41 0b36 ab25 A.5.Ul.....A.6.%
|
||||||
|
00001a90: 3bf0 0b01 2020 4c6f 636b 696e 6720 ffff ;... Locking ..
|
||||||
|
00001aa0: ff41 0835 8355 6ca7 00ff ffff 410b 36ab .A.5.Ul.....A.6.
|
||||||
|
00001ab0: 253b f00b 0120 204c 6f63 6b69 6e67 20ff %;... Locking .
|
||||||
|
00001ac0: ffff 4108 3583 556c a700 ffff ff41 0b36 ..A.5.Ul.....A.6
|
||||||
|
00001ad0: ab25 3bf0 0b01 2020 4c6f 636b 696e 6720 .%;... Locking
|
||||||
|
00001ae0: ffff ff41 0835 8355 6ca7 00ff ffff 410b ...A.5.Ul.....A.
|
||||||
|
00001af0: 36ab 253b f00b 0120 204c 6f63 6b69 6e67 6.%;... Locking
|
||||||
|
00001b00: 20ff ffff 4108 3583 556c a700 ffff ff41 ...A.5.Ul.....A
|
||||||
|
00001b10: 0b36 ab25 3bf0 0b01 2020 4c6f 636b 696e .6.%;... Lockin
|
||||||
|
00001b20: 6720 ffff ff41 0835 8355 6ca7 00ff ffff g ...A.5.Ul.....
|
||||||
|
00001b30: 410b 36ab 253b f00b 0120 204c 6f63 6b69 A.6.%;... Locki
|
||||||
|
00001b40: 6e67 20ff ffff 4108 3583 556c a700 ffff ng ...A.5.Ul....
|
||||||
|
00001b50: ff41 0b36 ab25 3bf0 0b01 2020 4c6f 636b .A.6.%;... Lock
|
||||||
|
00001b60: 696e 6720 00ff ffff 4108 3773 4f3c 9100 ing ....A.7sO<..
|
||||||
|
00001b70: ffff ff41 0b38 8d08 483e 0b01 2020 4c6f ...A.8..H>.. Lo
|
||||||
|
00001b80: 636b 696e 6720 ffff ff41 0837 734f 3c91 cking ...A.7sO<.
|
||||||
|
00001b90: 00ff ffff 410b 388d 0848 3e0b 0120 204c ....A.8..H>.. L
|
||||||
|
00001ba0: 6f63 6b69 6e67 20ff ffff 4108 3773 4f3c ocking ...A.7sO<
|
||||||
|
00001bb0: 9100 ffff ff41 0b38 8d08 483e 0b01 2020 .....A.8..H>..
|
||||||
|
00001bc0: 4c6f 636b 696e 6720 ffff ff41 0837 734f Locking ...A.7sO
|
||||||
|
00001bd0: 3c91 00ff ffff 410b 388d 0848 3e0b 0120 <.....A.8..H>..
|
||||||
|
00001be0: 204c 6f63 6b69 6e67 20ff ffff 4108 3773 Locking ...A.7s
|
||||||
|
00001bf0: 4f3c 9100 ffff ff41 0b38 8d08 483e 0b01 O<.....A.8..H>..
|
||||||
|
00001c00: 2020 4c6f 636b 696e 6720 ffff ff41 0837 Locking ...A.7
|
||||||
|
00001c10: 734f 3c91 00ff ffff 410b 388d 0848 3e0b sO<.....A.8..H>.
|
||||||
|
00001c20: 0120 204c 6f63 6b69 6e67 20ff ffff 4108 . Locking ...A.
|
||||||
|
00001c30: 3773 4f3c 9100 ffff ff41 0b38 8d08 483e 7sO<.....A.8..H>
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 533 KiB After Width: | Height: | Size: 822 KiB |
@@ -0,0 +1,515 @@
|
|||||||
|
# Machine-readable notes for this export
|
||||||
|
|
||||||
|
Companion to `README.md`, which says the same things in plain language for the
|
||||||
|
person this data belongs to. This file is the precise version: complete reference
|
||||||
|
tables, exact types, and the places where a careless reading goes wrong.
|
||||||
|
|
||||||
|
If you are an assistant helping someone read this folder, read this file first.
|
||||||
|
|
||||||
|
## Three things that will make you wrong
|
||||||
|
|
||||||
|
**1. `p` in the event log is not self-describing.**
|
||||||
|
It is a positional JSON array. The key order is *not* in the data — it is in the
|
||||||
|
per-code tables below. Do not guess field names from the values.
|
||||||
|
|
||||||
|
**2. `e` and `event_id` are unrelated numbering schemes.**
|
||||||
|
`e` in the event log says *what happened*. `event_id` in the statistics says *what is
|
||||||
|
being measured*. They collide and mean different things:
|
||||||
|
|
||||||
|
| Number | `e` (event log) | `event_id` (statistics) |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| 1 | Switched on or off | Switch or relay with energy metering |
|
||||||
|
| 4 | A battery-powered device woke up and reported | Temperature and humidity sensor |
|
||||||
|
| 8 | Brightness changed | Door, window or position sensor |
|
||||||
|
| 12 | Smoke alarm | Temperature sensor |
|
||||||
|
| 13 | An input (switch or button) changed | Gas or air-quality sensor |
|
||||||
|
| 16 | A Bluetooth temperature and humidity reading | Analogue input |
|
||||||
|
|
||||||
|
Never resolve one against the other.
|
||||||
|
|
||||||
|
**3. Absence is not nonexistence.** Whole categories were removed from this export by
|
||||||
|
policy, listed under "Excluded" below. If something is not here, that says nothing
|
||||||
|
about whether the account used it. Do not conclude the owner had no automations.
|
||||||
|
|
||||||
|
## Identity
|
||||||
|
|
||||||
|
One physical device, written three ways:
|
||||||
|
|
||||||
|
| Form | Value | Appears in |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| decimal | `XLQd6aExkzDOkdyDoV0KQer` | statistics `device_id` |
|
||||||
|
| hex | `XLQd6aExkzDOkdyDoV0KQer` | `device.json` id of channel 0, event `tag` |
|
||||||
|
| hex + channel | `XLQd6aExkzDOkdyDoV0KQer_<n>` | `device.json` ids, event `tag` |
|
||||||
|
|
||||||
|
Conversion: `parseInt("XLQd6aExkzDOkdyDoV0KQer", 16) === XLQd6aExkzDOkdyDoV0KQer`. Device ids beginning
|
||||||
|
with `X` are not numeric and have no hex form; they appear verbatim everywhere.
|
||||||
|
|
||||||
|
**Channels.** 1 channel(s). The bare hex id is channel 0;
|
||||||
|
`<hex>_N` is channel N. Each is a separate record with its own name, room and image,
|
||||||
|
but all are one physical unit.
|
||||||
|
|
||||||
|
| id | channel | name |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| `XLQd6aExkzDOkdyDoV0KQer` | 0 | Back door |
|
||||||
|
|
||||||
|
**Rooms.** `room_id` occurs in `device.json` and in the statistics as a bare
|
||||||
|
integer. Only the ids this bundle's own records use are resolved here; the home's
|
||||||
|
full room list is out of scope:
|
||||||
|
|
||||||
|
| `room_id` | name |
|
||||||
|
| --- | --- |
|
||||||
|
| 2 | Lab |
|
||||||
|
|
||||||
|
`room_id` records the assignment **at write time**, so one channel can carry several
|
||||||
|
across its history and a row does not tell you where the device is now. An id with
|
||||||
|
no name could not be resolved against the home's current rooms - it may be deleted,
|
||||||
|
or a sentinel written before assignment (`-10` occurs on a device's first day).
|
||||||
|
**Do not infer which.** It is listed rather than dropped so that no integer in the
|
||||||
|
data is left unexplained, and the same applies to `tariff_id`: a negative value
|
||||||
|
there is a placeholder, not a tariff you can look up.
|
||||||
|
|
||||||
|
## Joining the files
|
||||||
|
|
||||||
|
`event_log.tag` → channel number → `statistics.channel`:
|
||||||
|
|
||||||
|
```
|
||||||
|
XLQd6aExkzDOkdyDoV0KQer -> channel 0
|
||||||
|
XLQd6aExkzDOkdyDoV0KQer_N -> channel N
|
||||||
|
```
|
||||||
|
|
||||||
|
**A suffix is dependable; the absence of one is not.** Across seven houses and
|
||||||
|
~120,000 events a `_N` suffix never disagreed with the payload channel. That is an
|
||||||
|
observation, not a guarantee — treat it as a strong default, not an invariant to
|
||||||
|
assert on. A bare tag usually means channel 0 but sometimes does not —
|
||||||
|
Cury devices (event code 21) keep a bare tag and put the channel only in the
|
||||||
|
payload, and log entries written before roughly 19 December 2022 do the same for
|
||||||
|
other codes, from before the suffix existed.
|
||||||
|
|
||||||
|
So: **where the payload carries a channel, prefer it over the tag.** Fall back to the
|
||||||
|
tag suffix only for codes whose payload has no channel field. Getting this backwards
|
||||||
|
silently files one channel's history under another.
|
||||||
|
|
||||||
|
Payload position 1 is the channel for codes 1, 2, 5, 8, 11, 12, 13 and 21 only. For
|
||||||
|
every other code that position is something else entirely — `reason` for code 4,
|
||||||
|
`scnid` for code 6 — so do not read it as a channel there.
|
||||||
|
|
||||||
|
**A component reference is not a number, but it does join.** Add-on and virtual
|
||||||
|
components report `channel` as a reference — `enum:200`, `boolean:201`, `number:200`
|
||||||
|
— mostly under codes 17 and 22, and their tag carries no `_N` suffix. Coercing the
|
||||||
|
reference itself to an integer produces nonsense, but **the numeric part after the
|
||||||
|
colon is the statistics `channel`**: `number:200` joins to `channel` `200`. Split on
|
||||||
|
the colon rather than discarding the row. Confirmed against a real export.
|
||||||
|
|
||||||
|
Times do not join directly. Event `t` is an integer of **milliseconds since the Unix
|
||||||
|
epoch**; statistics `_time` is an **ISO 8601 string in UTC** marking the *start* of
|
||||||
|
the period the row covers. Convert before comparing.
|
||||||
|
|
||||||
|
## Inventory
|
||||||
|
|
||||||
|
| File | Rows | Bytes | Selected by |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| `device.json` | 1 channel(s) | — | hex id and `XLQd6aExkzDOkdyDoV0KQer_<n>` |
|
||||||
|
| `event_log.csv` | 4 | — | event `tag` |
|
||||||
|
| `last_known_state.json` | 3 key(s) | — | `DEV:XLQd6aExkzDOkdyDoV0KQer:*` |
|
||||||
|
| `images/` | 0 file(s) | — | `image` field of each channel |
|
||||||
|
|
||||||
|
The same inventory, for a tool rather than a reader. This device produced no
|
||||||
|
statistics at all, which the empty `files` list states rather than implies:
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"schema": "shelly-device-export/2",
|
||||||
|
"event_log": {
|
||||||
|
"rows": 4,
|
||||||
|
"matched": 4,
|
||||||
|
"withheld": 0,
|
||||||
|
"cap": 5,
|
||||||
|
"cap_scope": "device",
|
||||||
|
"per_tag": {
|
||||||
|
"XLQd6aExkzDOkdyDoV0KQer": 4
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"files": []
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Schemas
|
||||||
|
|
||||||
|
### `last_known_state.json`
|
||||||
|
|
||||||
|
The device's own view of itself, as the platform last cached it. Three sources,
|
||||||
|
each a Redis hash under `DEV:<decimal-id>:` in the per-server database that holds
|
||||||
|
device state:
|
||||||
|
|
||||||
|
| Member | Source key | Holds |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| `info` | `INFO` | identity and connection metadata — `id`, `id16`, `type`, `code`, `gen`, `online`, `conntime`, `ip` |
|
||||||
|
| `status` | `STATUS` | last reported component state, one member per component (`switch:0`, `input:1`, `wifi`, …) |
|
||||||
|
| `settings` | `SETTINGS` | device configuration as its own firmware reports it |
|
||||||
|
|
||||||
|
Hash field values are **JSON where they parse and the raw string where they do
|
||||||
|
not** — `code` is a bare model string, `wifi` is an object. Parse defensively.
|
||||||
|
Which of the three are present, which were not there at all, and which values were
|
||||||
|
blanked are all stated as data: `absent` and `redacted` in the file, and the
|
||||||
|
Provenance section below.
|
||||||
|
|
||||||
|
`[redacted]` marks a value removed because its key is secret-shaped. It means the
|
||||||
|
field existed and held something; a field that was empty is left as it was and is
|
||||||
|
**not** listed in `redacted`, so the list never implies a secret that never was.
|
||||||
|
|
||||||
|
### `event_log.csv`
|
||||||
|
|
||||||
|
| Column | Type | Notes |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| `tag` | string | `XLQd6aExkzDOkdyDoV0KQer` or `XLQd6aExkzDOkdyDoV0KQer_<n>` |
|
||||||
|
| `t` | integer | milliseconds since the Unix epoch, UTC |
|
||||||
|
| `e` | integer | event code; see the full table below |
|
||||||
|
| `p` | JSON string | positional array |
|
||||||
|
|
||||||
|
Rows: 4 of 4 matched, cap 5. Source table `event_logs` (version 1).
|
||||||
|
Range: 2026-10-21T07:10:53.259Z to 2026-10-21T07:22:58.358Z - the rows in this file.
|
||||||
|
Codes present: 18.
|
||||||
|
That list describes the rows this file carries, which may be a subset of what the
|
||||||
|
device produced - see Provenance for the counts. A code absent from it is not
|
||||||
|
evidence the device never produced one.
|
||||||
|
|
||||||
|
## Sentinels and traps
|
||||||
|
|
||||||
|
- Every timestamp in the data files is UTC - `event_log.csv` `t`.
|
||||||
|
It carries no offset, and there is no local-time *timestamp* anywhere.
|
||||||
|
`last_known_state.json` is the exception worth knowing about: it carries the
|
||||||
|
device's own clock configuration - a zone name, a UTC offset in seconds, and a
|
||||||
|
wall-clock string like `"15:50"`. Those describe the device, not the data, and
|
||||||
|
must not be used to reinterpret a timestamp that is already UTC.
|
||||||
|
- `device.json` `image` values under `images/device_images/` are stock artwork shipped
|
||||||
|
with the app, not uploads; only `assets/user_images/...` paths correspond to a file
|
||||||
|
in `images/`.
|
||||||
|
|
||||||
|
## Loading into SQLite
|
||||||
|
|
||||||
|
The most practical way to work with this, and it keeps the data on the machine it is
|
||||||
|
already on. Free GUI clients (DB Browser for SQLite, DBeaver) open the result.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
sqlite3 device.db
|
||||||
|
.mode csv
|
||||||
|
.import event_log.csv ev
|
||||||
|
```
|
||||||
|
|
||||||
|
**`.import` types every column TEXT.** Numeric work needs an explicit cast, or
|
||||||
|
`sum()` silently returns 0:
|
||||||
|
|
||||||
|
```sql
|
||||||
|
-- decode the event log: positional payload and epoch, in one pass
|
||||||
|
select datetime(cast(t as integer)/1000, 'unixepoch') as when_utc,
|
||||||
|
json_extract(p, '$[0]') as device,
|
||||||
|
json_extract(p, '$[1]') as channel,
|
||||||
|
json_extract(p, '$[2]') as value
|
||||||
|
from ev order by cast(t as integer);
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
## Data quality: what you may legitimately see
|
||||||
|
|
||||||
|
This is an export of what is stored, not a cleaned or corrected version. Some of it
|
||||||
|
will look wrong, and usually is wrong at source rather than in transit:
|
||||||
|
|
||||||
|
- **A device can be dead and still attached to the account.** It may keep reporting
|
||||||
|
implausible values, or stop reporting while still appearing in `device.json`. A
|
||||||
|
gap in the statistics is not evidence the device was off.
|
||||||
|
- **Firmware and platform changes alter what a device reports** over the years these
|
||||||
|
files cover. A field can change meaning, units, or stop being written, without
|
||||||
|
anything in the data marking the change.
|
||||||
|
- **Out-of-range readings are common** — a temperature of hundreds of degrees, an
|
||||||
|
energy spike, a battery above 100. These are what the device sent.
|
||||||
|
|
||||||
|
If you are summarising this for someone: **do not silently repair it.** Do not
|
||||||
|
interpolate gaps, drop outliers without saying so, or average across a discontinuity.
|
||||||
|
Report anomalies as anomalies — an average that quietly includes a nonsense spike is
|
||||||
|
worse than no average, and the person reading it cannot tell the difference.
|
||||||
|
|
||||||
|
## Reference: all event-log codes
|
||||||
|
|
||||||
|
The complete set the platform defines, independent of what this bundle contains - so
|
||||||
|
you can tell a code that is absent from this export from one that does not exist.
|
||||||
|
Which codes occur here is stated as data, in `Codes present:` above.
|
||||||
|
`keys` is the order of values in a positional payload.
|
||||||
|
|
||||||
|
**This reference reflects the platform as of 2026-10-23.** The
|
||||||
|
services that write this data change. A code may have been added, or a payload
|
||||||
|
reshaped, since this export was produced. Where the data disagrees with the table
|
||||||
|
below, the data is what we hold — trust it and say the table looks out of date.
|
||||||
|
|
||||||
|
| `e` | name | meaning | payload order |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| 1 | `onOff` | Switched on or off | `deviceId`, `channel`, `turn` |
|
||||||
|
| 2 | `overPower` | Power limit exceeded | `deviceId`, `channel` |
|
||||||
|
| 3 | `overTemperature` | Temperature limit exceeded | `deviceId`, `tmp` |
|
||||||
|
| 4 | `wakeUp` | A battery-powered device woke up and reported | `deviceId`, `reason`, `tmp`, `bat`, `alarm_hum` |
|
||||||
|
| 5 | `openCloseStop` | A blind or shutter opened, closed or stopped | `deviceId`, `channel`, `state`, `current_pos` |
|
||||||
|
| 6 | `sceneExec` | An automation ran | `tstamp`, `scnid` |
|
||||||
|
| 7 | `DwState` | A door or window opened or closed | `deviceId`, `reason`, `state`, `bat`, `lux_value`, `lux_illumination`, `tilt`, `vibration`, `tmp` |
|
||||||
|
| 8 | `brightness` | Brightness changed | `deviceId`, `channel`, `brightness` |
|
||||||
|
| 9 | `gasSensor` | Gas alarm changed | `deviceId`, `alarm_gas` |
|
||||||
|
| 10 | `motion` | Motion was detected | `deviceId`, `motion`, `bat`, `lux_value`, `lux_illumination`, `tmp` |
|
||||||
|
| 11 | `gen2Errors` | The device reported an error | `deviceId`, `channel`, `error`, `...error-specific values` |
|
||||||
|
| 12 | `smokeAlarm` | Smoke alarm | `deviceId`, `channel` |
|
||||||
|
| 13 | `inputState` | An input (switch or button) changed | `deviceId`, `channel`, `state`, `component` |
|
||||||
|
| 14 | `DwBleState` | A Bluetooth door or window sensor opened or closed | `deviceId`, `reason`, `state`, `bat`, `lux`, `tilt` |
|
||||||
|
| 15 | `MotionBleState` | A Bluetooth motion sensor detected motion | `deviceId`, `motion`, `bat`, `lux_value` |
|
||||||
|
| 16 | `HnTBLEState` | A Bluetooth temperature and humidity reading | `deviceId`, `tmp`, `hum`, `bat`, `lux_illumination` |
|
||||||
|
| 17 | `xModGeneric` | A reading from an add-on or Shelly X module | `deviceId`, `ref`, `value` |
|
||||||
|
| 18 | `lockState` | A lock was locked or unlocked | `deviceId`, `state` |
|
||||||
|
| 19 | `vibrationDistanceBatState` | A vibration or distance reading | `deviceId`, `state`, `distance`, `bat` |
|
||||||
|
| 20 | `presence` | Presence was detected | `deviceId`, `ref`, `state`, `num_objects` |
|
||||||
|
| 21 | `cury` | A Cury device changed state | `deviceId`, `channel`, `state`, `level` |
|
||||||
|
| 22 | `camera` | A camera detected motion | `deviceId`, `zone`, `motion`, `rec_id`, `media_id` |
|
||||||
|
| 23 | `breakerRPC` | A circuit breaker changed state | `deviceId`, `state`, `reason` |
|
||||||
|
| 24 | `cameraStatus` | A camera arm or privacy setting changed | `deviceId`, `arm`, `privacy` |
|
||||||
|
|
||||||
|
Payload key meanings:
|
||||||
|
|
||||||
|
| Key | Meaning |
|
||||||
|
| --- | --- |
|
||||||
|
| `deviceId` | the device this event came from |
|
||||||
|
| `channel` | which output or channel of the device |
|
||||||
|
| `turn` | true = switched on, false = switched off |
|
||||||
|
| `tmp` | temperature, in degrees Celsius |
|
||||||
|
| `hum` | relative humidity, in percent |
|
||||||
|
| `bat` | battery level remaining, in percent |
|
||||||
|
| `reason` | what prompted the report |
|
||||||
|
| `state` | the new state |
|
||||||
|
| `current_pos` | position, in percent |
|
||||||
|
| `tstamp` | when it happened, in milliseconds since 1 January 1970 (UTC) |
|
||||||
|
| `scnid` | the identifier of the automation that ran |
|
||||||
|
| `lux` | light level |
|
||||||
|
| `lux_value` | measured light level |
|
||||||
|
| `lux_illumination` | light level as a description (for example dark or bright) |
|
||||||
|
| `tilt` | tilt angle |
|
||||||
|
| `vibration` | whether vibration was detected |
|
||||||
|
| `brightness` | brightness, in percent |
|
||||||
|
| `alarm_gas` | gas alarm state |
|
||||||
|
| `alarm_hum` | humidity alarm state |
|
||||||
|
| `motion` | whether motion was detected |
|
||||||
|
| `error` | the error the device reported |
|
||||||
|
| `component` | which part of the device (for example an input) |
|
||||||
|
| `ref` | which sub-component reported |
|
||||||
|
| `value` | the reported value |
|
||||||
|
| `distance` | measured distance |
|
||||||
|
| `num_objects` | how many were detected |
|
||||||
|
| `level` | the reported level |
|
||||||
|
| `zone` | which camera zone |
|
||||||
|
| `rec_id` | recording identifier |
|
||||||
|
| `media_id` | media identifier |
|
||||||
|
| `arm` | whether the camera was armed |
|
||||||
|
| `privacy` | whether privacy mode was on |
|
||||||
|
|
||||||
|
Caveats worth carrying: the payload of code 4 varies by device model (a Gen2 smoke
|
||||||
|
sensor writes `[deviceId, reason, battery]`), and code 11 appends error-specific
|
||||||
|
values after `error`.
|
||||||
|
|
||||||
|
## Reference: measurement families
|
||||||
|
|
||||||
|
Every family this tool can export, independent of what this bundle contains, so an
|
||||||
|
absent `event_id` can be told from an undocumented one. This tool reads statistics at
|
||||||
|
the raw, `_1m`, `_1h` and `_1d` resolutions, and from the net metering, monthly and
|
||||||
|
archived-meter stores. Which of those appear in a given bundle depends on the
|
||||||
|
scope of the export, on what the device wrote, and on the options it ran with -
|
||||||
|
the file inventory above and Provenance below are what say. One thing is written by
|
||||||
|
the platform but falls outside that scope and is in no bundle:
|
||||||
|
|
||||||
|
- `overall_consumption` - Whole-platform consumption totals. These carry no tags at all, not even a home id, so no part of them belongs to any one account.
|
||||||
|
|
||||||
|
**This reference reflects the platform as of 2026-10-23.** Families
|
||||||
|
may have been added, or fields reshaped, since this export was produced. Where the
|
||||||
|
data disagrees with the table below, the data is what we hold.
|
||||||
|
|
||||||
|
Families present in this bundle: none.
|
||||||
|
|
||||||
|
| `event_id` | measurement | fields |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| 1 | Switch or relay with energy metering | `f1` channel number; `f2` mains voltage, in volts; `f3` energy used during the period, in watt-minutes - divide by 60000 for kwh; `f4` energy returned to the grid during the period, in watt-minutes - divide by 60000 for kwh |
|
||||||
|
| 4 | Temperature and humidity sensor | `f2` relative humidity, in percent; `f3` lowest humidity during the period, in percent; `f4` highest humidity during the period, in percent; `f5` lowest temperature during the period, in degrees celsius; `f6` highest temperature during the period, in degrees celsius |
|
||||||
|
| 8 | Door, window or position sensor | `f2` position, in percent; `f3` battery level remaining, in percent; `f5` lowest temperature during the period, in degrees celsius; `f6` highest temperature during the period, in degrees celsius |
|
||||||
|
| 10 | Energy meter | `f1` channel number; `f3` energy used during the period, in watt-hours - divide by 1000 for kwh; `f4` energy returned to the grid during the period, in watt-hours - divide by 1000 for kwh; `f5` lowest voltage during the period, in volts; `f6` highest voltage during the period, in volts |
|
||||||
|
| 12 | Temperature sensor | `f1` channel number; `f3` lowest temperature during the period, in degrees celsius; `f4` highest temperature during the period, in degrees celsius |
|
||||||
|
| 13 | Gas or air-quality sensor | `f1` measured concentration; `f2` measured concentration |
|
||||||
|
| 14 | Humidity sensor | `f1` channel number; `f3` lowest humidity during the period, in percent; `f4` highest humidity during the period, in percent |
|
||||||
|
| 15 | Voltage measurement | `f3` lowest voltage during the period, in volts; `f4` highest voltage during the period, in volts |
|
||||||
|
| 16 | Analogue input | `f3` lowest reading during the period, in percent; `f4` highest reading during the period, in percent |
|
||||||
|
| 17 | Counter or accumulated total | |
|
||||||
|
| 18 | Frequency, presence, soil or other generic sensor | |
|
||||||
|
| 19 | Generic counter | `counter` accumulated count |
|
||||||
|
| 20 | Weather station | `temperature` temperature, in degrees celsius; `min_temperature` lowest temperature during the period, in degrees celsius; `max_temperature` highest temperature during the period, in degrees celsius; `humidity` relative humidity, in percent; `pressure` air pressure; `min_pressure` lowest air pressure during the period; `max_pressure` highest air pressure during the period; `illuminance` light level, in lux; `precipitation` rainfall during the period; `uv` ultraviolet index; `wind_speed` wind speed |
|
||||||
|
| 21 | Air-quality sensor | `co2` carbon dioxide concentration, in ppm; `humidity` relative humidity, in percent; `min_temperature` lowest temperature during the period, in degrees celsius; `max_temperature` highest temperature during the period, in degrees celsius; `min_pressure` lowest air pressure during the period; `max_pressure` highest air pressure during the period |
|
||||||
|
|
||||||
|
## Reference: machine-readable summary
|
||||||
|
|
||||||
|
The parts of this document a tool should act on rather than read: the scale factors,
|
||||||
|
what makes a statistics row unique, the event log's per-tag cap, and the defects the
|
||||||
|
data is known to carry. Every value here is generated from the same constants that
|
||||||
|
produced the prose above, so the two cannot disagree. It states no retention window
|
||||||
|
for the statistics, deliberately - see *Expired* below.
|
||||||
|
|
||||||
|
A unit stated in English can be confidently wrong in a way a scale factor cannot -
|
||||||
|
these documents described the energy columns in the wrong unit for months, and every
|
||||||
|
sentence saying so agreed with every other. `to_kwh` is the number that settles it.
|
||||||
|
**Read it per family.** `f3` does not hold the same unit everywhere: a relay writes
|
||||||
|
watt-minutes and an energy meter writes watt-hours, which is a factor of 60 between
|
||||||
|
two columns of the same name. Match the `families` list against a row's `event_id`
|
||||||
|
rather than taking the first entry.
|
||||||
|
|
||||||
|
This describes the platform, not this bundle: it is identical in every export. The
|
||||||
|
measured figures for *this* one are in the Inventory block above.
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"schema": "shelly-device-export/2",
|
||||||
|
"columns": {
|
||||||
|
"f3": [
|
||||||
|
{
|
||||||
|
"families": [
|
||||||
|
1
|
||||||
|
],
|
||||||
|
"unit": "W·min",
|
||||||
|
"to_kwh": 0.000016666666666666667
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"families": [
|
||||||
|
10
|
||||||
|
],
|
||||||
|
"unit": "W·h",
|
||||||
|
"to_kwh": 0.001
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"f4": [
|
||||||
|
{
|
||||||
|
"families": [
|
||||||
|
1
|
||||||
|
],
|
||||||
|
"unit": "W·min",
|
||||||
|
"to_kwh": 0.000016666666666666667
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"families": [
|
||||||
|
10
|
||||||
|
],
|
||||||
|
"unit": "W·h",
|
||||||
|
"to_kwh": 0.001
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"energy_price": {
|
||||||
|
"scale_of": "f3",
|
||||||
|
"to_account_currency": [
|
||||||
|
{
|
||||||
|
"families": [
|
||||||
|
1
|
||||||
|
],
|
||||||
|
"factor": 0.000016666666666666667
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"families": [
|
||||||
|
10
|
||||||
|
],
|
||||||
|
"factor": 0.001
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"currency": null,
|
||||||
|
"currency_applies_to_rows": false,
|
||||||
|
"currency_at_export_in": "provenance"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"grain": [
|
||||||
|
"_time",
|
||||||
|
"channel",
|
||||||
|
"room_id",
|
||||||
|
"tariff_id"
|
||||||
|
],
|
||||||
|
"event_log_retention_per_tag_upstream": 100,
|
||||||
|
"known_gaps": [
|
||||||
|
{
|
||||||
|
"id": "daily-rollup-missing-2300-utc",
|
||||||
|
"summary": "`_1d` rows for days before 2026-09-23 omit the 23:00 UTC hour; the rollup was corrected on that date and rows from it are whole, so adding the hour back to a later row double-counts it.",
|
||||||
|
"families": null
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "f3-net-or-gross",
|
||||||
|
"summary": "`f3` is net of returned energy on some device families and gross on others, with nothing in the row to say which, so it can be negative.",
|
||||||
|
"families": [
|
||||||
|
1,
|
||||||
|
10
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Excluded — absence here means nothing
|
||||||
|
|
||||||
|
Five distinct reasons produce a gap in this bundle. **None of them is evidence about
|
||||||
|
the owner or the device**, and they are not interchangeable:
|
||||||
|
|
||||||
|
**1. Out of scope — held by the platform, deliberately not in a device export.**
|
||||||
|
|
||||||
|
- automations and scenes, including scene-execution events
|
||||||
|
- dashboards, groups, room definitions
|
||||||
|
- account-level records: identity, contact details, locale and display preferences,
|
||||||
|
billing data
|
||||||
|
- third-party integrations (for example Google Home sync)
|
||||||
|
- account ownership, access rights, server placement
|
||||||
|
- whole-house monthly energy reports
|
||||||
|
- every other device in the same home
|
||||||
|
|
||||||
|
This bundle is scoped to one device. It should contain no other device identifier.
|
||||||
|
Do not conclude the owner had no automations, or that the home had one device.
|
||||||
|
|
||||||
|
**2. Expired — deleted by retention, unavailable to anyone.** Each store keeps rows
|
||||||
|
for a window and the platform deletes them past it.
|
||||||
|
|
||||||
|
**The windows are not stated here, and should not be inferred.** They are configured
|
||||||
|
per server and are not uniform across the fleet - on at least one host the per-minute
|
||||||
|
store is deliberately longer than elsewhere. A figure printed in this document would
|
||||||
|
therefore be wrong for some bundles, which is exactly what happened before it was
|
||||||
|
removed: a real export understated its own per-minute window by 59 days. Use the
|
||||||
|
measured `first_period` and `last_period` in the Inventory block for what this bundle
|
||||||
|
actually covers, `distinct_periods` against that span for how much of it is present,
|
||||||
|
and do not prune a query against an assumed retention.
|
||||||
|
|
||||||
|
The event log is trimmed by count, not age: roughly the newest 100 records **per**
|
||||||
|
**`tag`**, older ones deleted as new arrive, so a busy channel reaches back less far
|
||||||
|
than a quiet one on the same device. A short file is evidence of that trimming, not
|
||||||
|
of inactivity, and the earliest row in a file is a trimming boundary rather than a
|
||||||
|
device's first day.
|
||||||
|
|
||||||
|
**3. Withheld — held by the platform, not included in this copy.** Unlike
|
||||||
|
reason 2, these records exist right now. Nothing has deleted them and a further
|
||||||
|
request can produce them.
|
||||||
|
|
||||||
|
No event-log records were withheld from this export: every record matching the device
|
||||||
|
is in the file.
|
||||||
|
|
||||||
|
**4. Never versioned — stored as a current setting, with no history.** Tariff names
|
||||||
|
and rates, and the account currency, are each a single value overwritten on change.
|
||||||
|
No history exists, so no snapshot of them could be attributed to a historical row and
|
||||||
|
none is included. What *is* attributable is `energy_price`, computed per row at write
|
||||||
|
time; `energy_price / f3` recovers the rate that applied then. The currency in force
|
||||||
|
when this export ran is in Provenance and applies to that moment only.
|
||||||
|
|
||||||
|
**5. Operational artefacts — the platform's data, not the subject's.**
|
||||||
|
device `ACTIONS` (Gen1 webhook configuration) and `CACHE` (BLE cloud-relay
|
||||||
|
bookkeeping), and stock artwork shipped with the app.
|
||||||
|
|
||||||
|
## Provenance
|
||||||
|
|
||||||
|
- Generated 2026-10-23T07:03:32.760Z
|
||||||
|
- Time zone: Europe/Vienna (from the home) - every timestamp in the data files is UTC regardless
|
||||||
|
- Built from splitty b669c97 (packed)
|
||||||
|
- Home `2531873`, device `XLQd6aExkzDOkdyDoV0KQer`
|
||||||
|
- Event log from `event_logs` (version 1)
|
||||||
|
- Account tier at export time: free
|
||||||
|
- Device state from `DEV:XLQd6aExkzDOkdyDoV0KQer:*` (local Redis db 0): INFO, STATUS, SETTINGS present
|
||||||
|
- Secret-shaped values blanked in `last_known_state.json`: 0
|
||||||
|
- Export scope: limited - the platform's 16 `_1m` and 14 raw series (its whole sub-hourly inventory, whatever subset of it this device writes) were not queried
|
||||||
|
- Event log: all 4 matching records included (cap 5, not reached)
|
||||||
|
- A `.sha256` sidecar sits next to the archive; the archive cannot contain its own
|
||||||
|
checksum, so verify with `sha256sum -c <name>.zip.sha256`
|
||||||
@@ -0,0 +1,219 @@
|
|||||||
|
# Your device data
|
||||||
|
|
||||||
|
This folder contains the data we hold about one of your Shelly devices, a
|
||||||
|
**LOQED**. It was prepared on 2026-10-23 in response to your request.
|
||||||
|
|
||||||
|
Every date and time in these files is **UTC**, which may differ from your local time.
|
||||||
|
|
||||||
|
## Your device
|
||||||
|
|
||||||
|
First seen on our systems: 2026-10-21 07:10:47
|
||||||
|
|
||||||
|
This device has a single channel.
|
||||||
|
|
||||||
|
| Channel | Your name for it | Identifier |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| 0 | Back door | `XLQd6aExkzDOkdyDoV0KQer` |
|
||||||
|
|
||||||
|
### The rooms these files mention
|
||||||
|
|
||||||
|
`room_id` appears in `device.json` as a number. These
|
||||||
|
are the ones your device's own records use:
|
||||||
|
|
||||||
|
| `room_id` | Room |
|
||||||
|
| --- | --- |
|
||||||
|
| 2 | Lab |
|
||||||
|
|
||||||
|
More than one room can appear for the same channel: the value recorded is the room
|
||||||
|
the channel was in **at the time**, so moving a device leaves older rows pointing at
|
||||||
|
where it used to be. Only rooms your device appears in are listed here.
|
||||||
|
|
||||||
|
## What is in this folder
|
||||||
|
|
||||||
|
| File | What it is |
|
||||||
|
| --- | --- |
|
||||||
|
| `device.json` | How the device was set up |
|
||||||
|
| `event_log.csv` | Things the device did — 4 record(s) |
|
||||||
|
| `last_known_state.json` | How the device was set up and what it last reported |
|
||||||
|
| `statistics/` | Empty — see “What is not here, and why” |
|
||||||
|
| `README.md` | This file |
|
||||||
|
|
||||||
|
| `AGENTS.md` | The same information written for software — precise formats and full |
|
||||||
|
| | reference tables |
|
||||||
|
|
||||||
|
**Start with `event_log.csv`** if you just want an overview — for this device it is
|
||||||
|
the record of what happened, and there are no measurements to read alongside it.
|
||||||
|
|
||||||
|
## Using an AI assistant, or a database
|
||||||
|
|
||||||
|
These files work well with an AI assistant, and `AGENTS.md` in this folder is written
|
||||||
|
for exactly that — point the tool at the folder and it will find it.
|
||||||
|
|
||||||
|
One thing to weigh first: this data describes your home and when you are in it, and
|
||||||
|
most AI services upload whatever you give them to their own servers. Pick one you
|
||||||
|
trust with that, or run a model on your own machine.
|
||||||
|
|
||||||
|
For anything more than a quick look, load the CSV files into **SQLite**. It handles
|
||||||
|
the largest of these files without complaining, and there are free tools with a normal
|
||||||
|
windowed interface — DB Browser for SQLite, or DBeaver. Nothing leaves your computer.
|
||||||
|
`AGENTS.md` has the exact commands.
|
||||||
|
|
||||||
|
## `device.json`
|
||||||
|
|
||||||
|
How the device and each of its channels were configured: the name you gave it, the
|
||||||
|
room you put it in and its model.
|
||||||
|
`image` is the picture shown in the app — where that points at
|
||||||
|
`assets/user_images/...` the file is in `images/`; anything else is stock artwork
|
||||||
|
supplied with the app and is not personal data.
|
||||||
|
|
||||||
|
## `last_known_state.json`
|
||||||
|
|
||||||
|
How this device was configured, and the last thing it reported to us before this
|
||||||
|
export was prepared. It is a snapshot, not a history — if the device has been
|
||||||
|
offline, this is how it looked when we last heard from it.
|
||||||
|
|
||||||
|
**It can mention your other devices by id.** Some devices depend on another one to
|
||||||
|
reach us — a battery sensor on Bluetooth, for instance, is relayed by a
|
||||||
|
mains-powered device nearby, and its state names the one that relayed it. Those
|
||||||
|
ids identify devices of yours, not anybody else's, and nothing those devices
|
||||||
|
recorded is in this folder.
|
||||||
|
|
||||||
|
## `event_log.csv`
|
||||||
|
|
||||||
|
4 record(s), from 2026-10-21T07:10:53.259Z to 2026-10-21T07:22:58.358Z.
|
||||||
|
|
||||||
|
| Column | Meaning |
|
||||||
|
| --- | --- |
|
||||||
|
| `tag` | Which channel of the device the record belongs to |
|
||||||
|
| `t` | When it happened, in **milliseconds since 1 January 1970 (UTC)** |
|
||||||
|
| `e` | What happened — see the table below |
|
||||||
|
| `p` | The details of the event |
|
||||||
|
|
||||||
|
To turn `t` into a date: divide by 1000 and read the result as a Unix timestamp. In a
|
||||||
|
spreadsheet, `=(t/86400000)+DATE(1970,1,1)` gives a normal date and time.
|
||||||
|
|
||||||
|
**This log is not a full history.** We keep about the newest 100 records for each
|
||||||
|
channel and delete older ones as new ones arrive, so it reaches back weeks or months
|
||||||
|
rather than years — and a busy channel reaches back less far than a quiet one.
|
||||||
|
|
||||||
|
### What the `e` values in your file mean
|
||||||
|
|
||||||
|
| `e` | Meaning |
|
||||||
|
| --- | --- |
|
||||||
|
| 18 | A lock was locked or unlocked |
|
||||||
|
|
||||||
|
Only the values that occur in your file are listed. Other kinds of device produce
|
||||||
|
other kinds of record.
|
||||||
|
|
||||||
|
### Reading the `p` column
|
||||||
|
|
||||||
|
In this export the details are stored as a **list, in a fixed order** — the names are
|
||||||
|
not repeated on every row, to keep the file small. Read the values positionally:
|
||||||
|
|
||||||
|
**`e` = 18** — A lock was locked or unlocked
|
||||||
|
|
||||||
|
| Position | Name | Meaning |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| 1 | `deviceId` | the device this event came from |
|
||||||
|
| 2 | `state` | the new state |
|
||||||
|
|
||||||
|
So a row reading `["c8f09e87cea0",0,true]` against `e` = 1 means: this device,
|
||||||
|
channel 0, switched on.
|
||||||
|
|
||||||
|
## Questions you might have
|
||||||
|
|
||||||
|
**Why does the time not match my clock?** All times are UTC.
|
||||||
|
Your time zone is **Europe/Vienna**, so a row stamped `2026-01-15T22:00:00Z`
|
||||||
|
is 15 January, late evening, where you are — and a row stamped just after midnight
|
||||||
|
UTC may belong to the previous day locally. Spreadsheets do not convert this for
|
||||||
|
you: add your offset to the value before grouping by day, or the first hours of
|
||||||
|
each local day land in the wrong one.
|
||||||
|
|
||||||
|
**Some readings look wrong.** Very likely they are — but they are what your device
|
||||||
|
sent us, and we have exported it unaltered rather than tidying it up. A device that
|
||||||
|
has failed can keep reporting nonsense while it is still listed on your account.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## How this export was produced
|
||||||
|
|
||||||
|
Device `XLQd6aExkzDOkdyDoV0KQer`, also written `XLQd6aExkzDOkdyDoV0KQer` in some files. Home `2531873`.
|
||||||
|
Generated 2026-10-23T07:03:32.760Z.
|
||||||
|
Times below are UTC. This home is set to
|
||||||
|
**Europe/Vienna**.
|
||||||
|
|
||||||
|
The same device is identified two ways depending on the file, which is why both forms
|
||||||
|
appear above:
|
||||||
|
|
||||||
|
| Form | Value | Used in |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| Decimal | `XLQd6aExkzDOkdyDoV0KQer` | our internal records for this device |
|
||||||
|
| Hexadecimal | `XLQd6aExkzDOkdyDoV0KQer`, `XLQd6aExkzDOkdyDoV0KQer_<n>` | `device.json`, the event log `tag` |
|
||||||
|
|
||||||
|
| File | Selected by | Amount |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| `device.json` | the identifiers above | 1 channel(s) |
|
||||||
|
| `event_log.csv` | the event `tag` | 4 record(s) |
|
||||||
|
| `statistics/` | the `device_id` tag | 0 row(s) in 0 file(s) |
|
||||||
|
| `images/` | the `image` setting of each channel | 0 file(s) |
|
||||||
|
|
||||||
|
The event log was read from `event_logs` (version 1), covering
|
||||||
|
2026-10-21T07:10:53.259Z to 2026-10-21T07:22:58.358Z.
|
||||||
|
|
||||||
|
This export was made to match what your **free plan** provides.
|
||||||
|
|
||||||
|
- The event log holds your 5 most recent records.
|
||||||
|
|
||||||
|
### What is not here, and why
|
||||||
|
|
||||||
|
Something you expected may be missing for six quite different reasons.
|
||||||
|
They are not the same, and the difference matters:
|
||||||
|
|
||||||
|
**1. It is not part of a device export.** This folder is about one device. We still
|
||||||
|
hold the following — it was left out on purpose, not lost, and you can ask for it:
|
||||||
|
|
||||||
|
- your account details: name, email, language, display preferences, billing
|
||||||
|
- your home's layout — room definitions, dashboards and groups
|
||||||
|
- automations and scenes, including records of automations running
|
||||||
|
- connections to other services such as Google Home
|
||||||
|
- account ownership and access rights
|
||||||
|
- whole-home monthly energy reports
|
||||||
|
- our internal server records
|
||||||
|
- the data belonging to every other device in your home
|
||||||
|
|
||||||
|
The rooms your device itself appears in are named earlier in this file, because its
|
||||||
|
own records would be unreadable without them.
|
||||||
|
|
||||||
|
**2. It is no longer stored.** Detailed measurements are deleted as they age, and the
|
||||||
|
event log keeps only the most recent records per channel. Anything past that is gone
|
||||||
|
from our systems entirely and cannot be exported by anyone — by us, or by you asking
|
||||||
|
again.
|
||||||
|
How long each level of detail survives is not fixed, so this export does not quote a
|
||||||
|
figure it cannot stand behind.
|
||||||
|
|
||||||
|
**3. We have it, and this copy does not include it.** Nothing was held back from this
|
||||||
|
export — but if you ever receive a copy that is shortened, it will say so here with
|
||||||
|
the numbers, so that a shortened copy can never be mistaken for everything we hold.
|
||||||
|
|
||||||
|
**4. Your device does not record it.** Not every device takes every
|
||||||
|
measurement. A relay without power metering, a door or window sensor, an input or
|
||||||
|
button report what happened rather than measuring anything; and a device that does
|
||||||
|
measure still leaves untouched the columns meant for sensors it does not have.
|
||||||
|
That is why there is no `statistics/` content here at all, and there never was.
|
||||||
|
Nothing was deleted or held back: it was never recorded in the first place, and no
|
||||||
|
request to us can produce it.
|
||||||
|
|
||||||
|
**5. It is a setting, and we keep no record of what it used to be.** Your tariffs and
|
||||||
|
your currency are stored as one current value each: changing one overwrites the old
|
||||||
|
one, and nothing anywhere remembers what it was on a given day.
|
||||||
|
|
||||||
|
**6. It belongs to us rather than to you.** Some of what we store about a device is
|
||||||
|
cloud housekeeping — how it was relayed, what was cached for it — rather than anything
|
||||||
|
about you, and that is left out. Only photographs you uploaded are included; stock
|
||||||
|
artwork supplied with the app is not.
|
||||||
|
|
||||||
|
### Checking the files arrived intact
|
||||||
|
|
||||||
|
A `.sha256` file was produced alongside this archive. To confirm nothing was altered
|
||||||
|
in transit, run `sha256sum -c <name>.zip.sha256` (Linux) or
|
||||||
|
`shasum -a 256 -c <name>.zip.sha256` (macOS) in the folder holding the archive.
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{
|
||||||
|
"id": "XLQd6aExkzDOkdyDoV0KQer",
|
||||||
|
"cts": "2026-10-21 07:10:47",
|
||||||
|
"type": "LOQED",
|
||||||
|
"channels": [
|
||||||
|
{
|
||||||
|
"id": "XLQd6aExkzDOkdyDoV0KQer",
|
||||||
|
"name": "Back door",
|
||||||
|
"channel": 0,
|
||||||
|
"channels_count": 1,
|
||||||
|
"room_id": 2,
|
||||||
|
"mode": "",
|
||||||
|
"category": "lock",
|
||||||
|
"image": "images/device_images/LOQED.png"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
"tag","t","e","p"
|
||||||
|
"XLQd6aExkzDOkdyDoV0KQer",1792566653259,18,"[""XLQd6aExkzDOkdyDoV0KQer"",""night_locking""]"
|
||||||
|
"XLQd6aExkzDOkdyDoV0KQer",1792566670773,18,"[""XLQd6aExkzDOkdyDoV0KQer"",""day_locking""]"
|
||||||
|
"XLQd6aExkzDOkdyDoV0KQer",1792566698562,18,"[""XLQd6aExkzDOkdyDoV0KQer"",""day_lock""]"
|
||||||
|
"XLQd6aExkzDOkdyDoV0KQer",1792567378358,18,"[""XLQd6aExkzDOkdyDoV0KQer"",""day_lock""]"
|
||||||
|
@@ -0,0 +1,47 @@
|
|||||||
|
{
|
||||||
|
"info": {
|
||||||
|
"_updated": "2026-10-23 06:23:04",
|
||||||
|
"id": "XLQd6aExkzDOkdyDoV0KQer",
|
||||||
|
"id16": "XLQd6aExkzDOkdyDoV0KQer",
|
||||||
|
"type": "lock",
|
||||||
|
"code": "LOQED",
|
||||||
|
"online": 1,
|
||||||
|
"conntime": 1792736584,
|
||||||
|
"ip": "",
|
||||||
|
"gen": "GXL"
|
||||||
|
},
|
||||||
|
"status": {
|
||||||
|
"id": "d6aExkzDOkdyDoV0KQer",
|
||||||
|
"name": "Back door",
|
||||||
|
"model_name": "LOQED Touch",
|
||||||
|
"battery_percentage": -1,
|
||||||
|
"battery_type": "alkaline",
|
||||||
|
"bolt_state": "unknown",
|
||||||
|
"party_mode": false,
|
||||||
|
"guest_access_mode": false,
|
||||||
|
"twist_assist": false,
|
||||||
|
"touch_to_connect": false,
|
||||||
|
"lock_direction": "clockwise",
|
||||||
|
"mortise_lock_type": "cylinder_operated_handle_on_the_outside",
|
||||||
|
"supported_lock_states": [
|
||||||
|
"day_lock",
|
||||||
|
"night_lock"
|
||||||
|
],
|
||||||
|
"online": true,
|
||||||
|
"bridge_ip": "10.12.2.20",
|
||||||
|
"bridge_hostname": "LOQED-8c4b146a1acc.local",
|
||||||
|
"local_id": 0,
|
||||||
|
"serial": 3110,
|
||||||
|
"_updated": "2026-10-23 06:23:04",
|
||||||
|
"_preoffline_battery_percentage": 78,
|
||||||
|
"_preoffline_bolt_state": "day_lock"
|
||||||
|
},
|
||||||
|
"settings": {
|
||||||
|
"device": {
|
||||||
|
"sleep_mode": false
|
||||||
|
},
|
||||||
|
"_updated": "2026-10-23 06:23:04"
|
||||||
|
},
|
||||||
|
"absent": [],
|
||||||
|
"redacted": []
|
||||||
|
}
|
||||||
Binary file not shown.
@@ -0,0 +1,172 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","api.production.loqed.com/34.155.200.196","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","api.production.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","api.production.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||||
|
"SSLv3","api.production.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||||
|
"TLS1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"TLS1_3","api.production.loqed.com/34.155.200.196","443","OK","offered with final","",""
|
||||||
|
"NPN","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"ALPN_HTTP2","api.production.loqed.com/34.155.200.196","443","OK","h2","",""
|
||||||
|
"ALPN","api.production.loqed.com/34.155.200.196","443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","api.production.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","api.production.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","api.production.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","api.production.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||||
|
"cipher-tls1_2_xc02f","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc013","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc014","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9c","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x9d","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x2f","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x35","api.production.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","api.production.loqed.com/34.155.200.196","443","INFO","true","",""
|
||||||
|
"cipher_order-tls1_3","api.production.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_3_x1302","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","api.production.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_3","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher_order","api.production.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","",""
|
||||||
|
"FS","api.production.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"FS_ciphers","api.production.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"FS_KEMs","api.production.loqed.com/34.155.200.196","443","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","api.production.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||||
|
"FS_TLS12_sig_algs","api.production.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||||
|
"FS_TLS13_sig_algs","api.production.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||||
|
"TLS_extensions","api.production.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","api.production.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","",""
|
||||||
|
"SSL_sessionID_support","api.production.loqed.com/34.155.200.196","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","api.production.loqed.com/34.155.200.196","443","INFO","not supported","",""
|
||||||
|
"sessionresumption_ID","api.production.loqed.com/34.155.200.196","443","INFO","supported","",""
|
||||||
|
"TLS_timestamp","api.production.loqed.com/34.155.200.196","443","INFO","random","",""
|
||||||
|
"certificate_compression","api.production.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||||
|
"clientAuth","api.production.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||||
|
"cert_numbers","api.production.loqed.com/34.155.200.196","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","api.production.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","api.production.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","api.production.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","api.production.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","",""
|
||||||
|
"cert_serialNumber","api.production.loqed.com/34.155.200.196","443","INFO","056B01F8C0078A7719EB49BF14357173112F","",""
|
||||||
|
"cert_serialNumberLen","api.production.loqed.com/34.155.200.196","443","INFO","18","",""
|
||||||
|
"cert_fingerprintSHA1","api.production.loqed.com/34.155.200.196","443","INFO","6A4E93FA165A64A590BF098743A6D7DD99911DEE","",""
|
||||||
|
"cert_fingerprintSHA256","api.production.loqed.com/34.155.200.196","443","INFO","11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","",""
|
||||||
|
"cert","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","api.production.loqed.com/34.155.200.196","443","OK","api.production.loqed.com","",""
|
||||||
|
"cert_commonName_wo_SNI","api.production.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","",""
|
||||||
|
"cert_subjectAltName","api.production.loqed.com/34.155.200.196","443","INFO","api.production.loqed.com","",""
|
||||||
|
"cert_trust","api.production.loqed.com/34.155.200.196","443","OK","Ok via SAN and CN (SNI mandatory)","",""
|
||||||
|
"cert_chain_of_trust","api.production.loqed.com/34.155.200.196","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","api.production.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","api.production.loqed.com/34.155.200.196","443","OK","86 >= 30 days","",""
|
||||||
|
"cert_notBefore","api.production.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:16","",""
|
||||||
|
"cert_notAfter","api.production.loqed.com/34.155.200.196","443","OK","2027-01-30 01:16","",""
|
||||||
|
"cert_extlifeSpan","api.production.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","api.production.loqed.com/34.155.200.196","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","api.production.loqed.com/34.155.200.196","443","INFO","http://yr2.c.lencr.org/48.crl","",""
|
||||||
|
"cert_ocspURL","api.production.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||||
|
"OCSP_stapling","api.production.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"cert_mustStapleExtension","api.production.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","api.production.loqed.com/34.155.200.196","443","LOW","--","",""
|
||||||
|
"certificate_transparency","api.production.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","api.production.loqed.com/34.155.200.196","443","INFO","3","",""
|
||||||
|
"certs_list_ordering_problem","api.production.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","api.production.loqed.com/34.155.200.196","443","INFO","YR2 (Let's Encrypt from US)","",""
|
||||||
|
"intermediate_cert <#1>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","api.production.loqed.com/34.155.200.196","443","INFO","238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","api.production.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","api.production.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","api.production.loqed.com/34.155.200.196","443","INFO","YR2 <-- Root YR","",""
|
||||||
|
"intermediate_cert <#2>","api.production.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","api.production.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","api.production.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","api.production.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","api.production.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","api.production.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","",""
|
||||||
|
"intermediate_cert_badOCSP","api.production.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","api.production.loqed.com/34.155.200.196","443","WARN","Unexpected 415 Unsupported Media Type @ '/'","",""
|
||||||
|
"HTTP_clock_skew","api.production.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","api.production.loqed.com/34.155.200.196","443","INFO","1793777783","",""
|
||||||
|
"HSTS","api.production.loqed.com/34.155.200.196","443","LOW","not offered","",""
|
||||||
|
"HPKP","api.production.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","api.production.loqed.com/34.155.200.196","443","INFO","No Server banner line in header, interesting!","",""
|
||||||
|
"banner_application","api.production.loqed.com/34.155.200.196","443","INFO","No application banner found","",""
|
||||||
|
"cookie_count","api.production.loqed.com/34.155.200.196","443","INFO","1 at '/' (maybe missed the application)","",""
|
||||||
|
"cookie_secure","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as secure","",""
|
||||||
|
"cookie_httponly","api.production.loqed.com/34.155.200.196","443","OK","All (1) at '/' marked as HttpOnly (maybe missed the application)","",""
|
||||||
|
"security_headers","api.production.loqed.com/34.155.200.196","443","MEDIUM","--","",""
|
||||||
|
"banner_reverseproxy","api.production.loqed.com/34.155.200.196","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","api.production.loqed.com/34.155.200.196","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","api.production.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","api.production.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","api.production.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","api.production.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","api.production.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_X","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_15","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","api.production.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_7u25","api.production.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1102","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1703","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_2106","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-go_1178","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"clientsimulation-openssl_102e","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-openssl_315","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-openssl_350","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","api.production.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"rating_spec","api.production.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","api.production.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","api.production.loqed.com/34.155.200.196","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","30","",""
|
||||||
|
"key_exchange_score","api.production.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","27","",""
|
||||||
|
"cipher_strength_score","api.production.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","api.production.loqed.com/34.155.200.196","443","INFO","36","",""
|
||||||
|
"final_score","api.production.loqed.com/34.155.200.196","443","INFO","93","",""
|
||||||
|
"overall_grade","api.production.loqed.com/34.155.200.196","443","OK","A+","",""
|
||||||
|
@@ -0,0 +1,225 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<--</span>
|
||||||
|
|
||||||
|
rDNS (34.155.200.196): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
|
||||||
|
SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>api.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>api.production.loqed.com </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (SNI mandatory)
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:16 --> 2027-01-30 01:16)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr2.c.lencr.org/48.crl
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>YR2</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR2</i> <-- <i>Root YR</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 415 Unsupported Media Type<span style="color:#cd00cd;">. Oh, didn't expect "415 Unsupported Media Type"</span>
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>1 issued: <span style="color:#008817;">1/1</span> secure, <span style="color:#008817;">1/1</span> HttpOnly -- HTTP status 415 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span><span style="color:#c05600;">--</span>
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,777 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793777755",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "api.production.loqed.com",
|
||||||
|
"ip" : "34.155.200.196",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN_HTTP2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "h2"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "true"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- TLS 1.3 client determined"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "valid for 604800 seconds (>daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "056B01F8C0078A7719EB49BF14357173112F"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "18"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "6A4E93FA165A64A590BF098743A6D7DD99911DEE"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFCjCCA/KgAwIBAgISBWsB+MAHincZ60m/FDVxcxEvMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYxMTAxMDExNjU1WhcNMjcwMTMwMDExNjU0WjAjMSEwHwYDVQQDExhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmML7dEETkxtCm3RTDN6l6oAXQkdoAXgWr0c1Qegutc5aM/xzEHspmEoMeMYM4L4RiMt/lFyCl2W51vJioBNoqhZN9bqjvBIH2k0+JgcGWn5QS7xdRT1ixSwYaiPCGUu7Vv0AjXUbhV/R0y7ZfWEZLwmzH7GGdvOtijrE6zj1rY56BCyCsDLLsY3nEJYbtHdfhmlTt1ni+QShJVDVNSWrFHRS7QmAGzUQaOx16bJtRB/A3xhkq2olYHn+fHL+7dpuXiflV31+usU+VDI2b6VxxdVhQS1VJB8jGZK+6n+r03u03l4a7L9Cl7r/lVifitPb0zjDBGOIB3Zl+iQLaR+qTAgMBAAGjggImMIICIjAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUD5BDamcgKcYrLVnlh8DX4/VtulUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaghhhcGkucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMi5jLmxlbmNyLm9yZy80OC5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdwBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAAAaGU4+RNAAAEAwBIMEYCIQDQB7bgE96N18CW2c2YA/fwwsEwwLO+MXxMrnyLORgTUgIhALTLt8P+xjpGs4w7t7bDhb4Y9nWkdlcW4BdgRIS72fvCAH0AGouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLEAAAGhlOPpFAAIAAAFABDX6zQEAwBGMEQCIFMvVP/NES40A+g/tQWjmaoS1TzzxpVdEU1GIxY2HP7CAiBrhBqZnHAvrxzg8yxliUDNnH/TaCB3y2nJwM+qX8Xw0zANBgkqhkiG9w0BAQsFAAOCAQEAJZR0nPe6vTiJ3wiwbPzW2MgvawgHMfVxNgrAbJNBQOVnmwBAD1coOymvvUAKa8Joes+JenfUMoJC3dGW64EUrGDTmSiBC5ui12Gl3QlfW0HXCJ+dEdlz5wRt3H2S2eAdgPxw75SJaVRiTu2Q0hO7p2cyJJNAexQAsJ1SHYNQoFVv5TqzPmpG2hrBF4gRt0CS0IEzlu4UYEuekHq1UczPBKQVCINsc7Uj5Cyi88cO1QVRHPMcQ/kImKIjY2k/ZpT9MpSo5UuwM6luOieru5wdgX90XXYG9c4tCjDwy4Bil8Om59BUIpyg14XDxLw0i+8vUhpV1tytqjs3jbGEixhmiw==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "api.production.loqed.com"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TRAEFIK DEFAULT CERT"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "api.production.loqed.com"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN and CN (SNI mandatory)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "86 >= 30 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-11-01 01:16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-30 01:16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://yr2.c.lencr.org/48.crl"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "3"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YR2 (Let's Encrypt from US)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2jCCAsKgAwIBAgIQTr0klH4k05SALYSlL9WzGTANBgkqhkiG9w0BAQsFADAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ0LxwBppqh84luqMerV/eeL/fXQ7mLQQv1LnpWKZbyvGpx6wh6AfnslAnF6ewTkcHA+gSOoBvm3Dfm06AuGiF+KRut4fAcowqnAQQCW98+QPP/eOv/wug7Iyk4NkOxf2I6g2f55T6nJoOTLFcukeRq80JGQEYan+dPFr9OGUgQK2hGKgNkW87pappsOAuUJcroYhRt5uUis4qaZireiseu32gzDJNBAiKtsvd6HX4v25bpkRNcS/B/Gtc9kVbUpD+2PLPxdei3Tim55k4tfAEXwD2qyiPTxrTNq6lN+AMr5g2c1dNqkOTwjxeV6L5lpP1rGiYvLnRaPlOqyZRPW+5AgMBAAGjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFEAVLSZ57TIgnt+ach3WMh+BDIEMMB8GA1UdIwQYMBaAFN7nW2DQIm1AKH0/DQH+pLVStFGUMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3lyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veXIuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQB0ZUQWZ9/Yn9COEpo+JfecMnB0h0vwDm/M66IqXqw3LoaLmx9lZvRTeDIS67PUeI3yCA2W6PKRD0/FE/G57lOmS+Xy5AaaL00ICGOqjNcCaMWW8o8nevHOd4i4lqgtznE/28QwlcdJyF8yBiWHpnyjhEpmNWJURgOCOg2xpwRMBCsjMScqYPtOhBeuYQvSwAEeTML2Ukh6uGuX4E14q65Ja8cdjF5bAldnP1eE4FBaAwsZG2fOqqrKV03Y85Nw2btedP1AtliQuJZs/Jo/gXxXdc7LrH3McgnpnbTiAncX7yEShP6kzQejllqMCIt52HOjxDGWafS7Xw+DKwqmH+Eqy8dcbOuag/1AYlQoKNVK3F5qHh6tEDiMqQcLIibGKteE6iHo4A/bIScbzrhXUYuism42ZYzmc48FMVIH3qy4L84ETdAH2gtxw0PAhvRVXp8HP7wfngpzsN/8xOTpeRSbM4+Qbc56G6+Bifmv6sk1ieQbNA3wJdl4DDUuQSV8hBgx6zoI1ZSGORprDFux7c6rhc77QZMSRrEgomBeklervEve86ylWmZ3WWHV6RLMi8xNvjd71r4EPIGgY7BZU/VPBkq+uA7Gb6mbJnFgV43uh3xyLRFgxIAphIukwTGSMZZR+AI+Qnp0BYTWovHXozOf3H8r6hozEoT02JHn0AeTfA==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "238B85A0099C65B970477D5724F1A1D475CE5058CFFE4EFA8733899BDB863C47"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-09-03 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2028-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YR2 <-- Root YR"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-05-13 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2032-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Root YR <-- ISRG Root X1"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "WARN",
|
||||||
|
"finding" : "Unexpected 415 Unsupported Media Type @ '/'"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793777783"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No Server banner line in header, interesting!"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_secure",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "All (1) at '/' marked as secure"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_httponly",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "All (1) at '/' marked as HttpOnly (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "security_headers",
|
||||||
|
"severity" : "MEDIUM",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 67
|
||||||
|
}
|
||||||
@@ -0,0 +1,204 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_loqed_api api.production.loqed.com:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 08:35:56 -->> 34.155.200.196:443 (api.production.loqed.com) <<--[m
|
||||||
|
|
||||||
|
rDNS (34.155.200.196): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets no, ID: yes
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication
|
||||||
|
[1m Serial [m056B01F8C0078A7719EB49BF14357173112F (OK: length 18)
|
||||||
|
[1m Fingerprints [mSHA1 6A4E93FA165A64A590BF098743A6D7DD99911DEE
|
||||||
|
SHA256 11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||||
|
[1m Common Name (CN) [m[3mapi.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||||
|
[1m subjectAltName (SAN) [m[3mapi.production.loqed.com [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (SNI mandatory)
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:16 --> 2027-01-30 01:16)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [mhttp://yr2.c.lencr.org/48.crl
|
||||||
|
[1m OCSP URI [m--
|
||||||
|
[1m OCSP stapling [mnot offered
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 3
|
||||||
|
[1m Issuer [m[3mYR2[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR2[m <-- [3mRoot YR[m
|
||||||
|
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 415 Unsupported Media Type[0;35m. Oh, didn't expect "415 Unsupported Media Type"[m
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m1 issued: [0;32m1/1[m secure, [0;32m1/1[m HttpOnly -- HTTP status 415 signals you maybe missed the web application
|
||||||
|
[1m Security headers [m[0;33m--[m
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=11A4CBD0A93B644101ADCD643272B0CC18AD1798950CAB87B62176DF3E597998
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 08:37:02 [ 67s] -->> 34.155.200.196:443 (api.production.loqed.com) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,172 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","integrations.loqed.com/34.155.200.196","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","integrations.loqed.com/34.155.200.196","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","integrations.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||||
|
"SSLv3","integrations.loqed.com/34.155.200.196","443","OK","not offered","",""
|
||||||
|
"TLS1","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"TLS1_3","integrations.loqed.com/34.155.200.196","443","OK","offered with final","",""
|
||||||
|
"NPN","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"ALPN_HTTP2","integrations.loqed.com/34.155.200.196","443","OK","h2","",""
|
||||||
|
"ALPN","integrations.loqed.com/34.155.200.196","443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","integrations.loqed.com/34.155.200.196","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","integrations.loqed.com/34.155.200.196","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","integrations.loqed.com/34.155.200.196","443","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","integrations.loqed.com/34.155.200.196","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||||
|
"cipher-tls1_2_xc02f","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc013","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc014","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9c","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x9d","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x2f","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x35","integrations.loqed.com/34.155.200.196","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","integrations.loqed.com/34.155.200.196","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","integrations.loqed.com/34.155.200.196","443","INFO","true","",""
|
||||||
|
"cipher_order-tls1_3","integrations.loqed.com/34.155.200.196","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_3_x1302","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","integrations.loqed.com/34.155.200.196","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_3","integrations.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher_order","integrations.loqed.com/34.155.200.196","443","OK","server -- TLS 1.3 client determined","",""
|
||||||
|
"FS","integrations.loqed.com/34.155.200.196","443","OK","offered","",""
|
||||||
|
"FS_ciphers","integrations.loqed.com/34.155.200.196","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"FS_KEMs","integrations.loqed.com/34.155.200.196","443","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","integrations.loqed.com/34.155.200.196","443","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||||
|
"FS_TLS12_sig_algs","integrations.loqed.com/34.155.200.196","443","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||||
|
"FS_TLS13_sig_algs","integrations.loqed.com/34.155.200.196","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||||
|
"TLS_extensions","integrations.loqed.com/34.155.200.196","443","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","integrations.loqed.com/34.155.200.196","443","LOW","valid for 604800 seconds (>daily)","",""
|
||||||
|
"SSL_sessionID_support","integrations.loqed.com/34.155.200.196","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","integrations.loqed.com/34.155.200.196","443","INFO","not supported","",""
|
||||||
|
"sessionresumption_ID","integrations.loqed.com/34.155.200.196","443","INFO","supported","",""
|
||||||
|
"TLS_timestamp","integrations.loqed.com/34.155.200.196","443","INFO","random","",""
|
||||||
|
"certificate_compression","integrations.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||||
|
"clientAuth","integrations.loqed.com/34.155.200.196","443","INFO","none","",""
|
||||||
|
"cert_numbers","integrations.loqed.com/34.155.200.196","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","integrations.loqed.com/34.155.200.196","443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","integrations.loqed.com/34.155.200.196","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","integrations.loqed.com/34.155.200.196","443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","integrations.loqed.com/34.155.200.196","443","INFO","TLS Web Server Authentication","",""
|
||||||
|
"cert_serialNumber","integrations.loqed.com/34.155.200.196","443","INFO","05C73CE106F84ABAC4E6D524DA93450B2C1C","",""
|
||||||
|
"cert_serialNumberLen","integrations.loqed.com/34.155.200.196","443","INFO","18","",""
|
||||||
|
"cert_fingerprintSHA1","integrations.loqed.com/34.155.200.196","443","INFO","80EDD7ED1004483BFF5FAC76EEB5BD58638464FF","",""
|
||||||
|
"cert_fingerprintSHA256","integrations.loqed.com/34.155.200.196","443","INFO","F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962","",""
|
||||||
|
"cert","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFNTCCBB2gAwIBAgISBcc84Qb4SrrE5tUk2pNFCywcMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAsMSowKAYDVQQDEyFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPWD0p9X/7gALsv5hZ8dAORgWdrVJVMiDF8goE/bywu79SsUIgjHP3ydju2CM14hvVPPFbvBHNBtisztJKz22JoqMYA+06nnlGjrxwaffepVTOlbvcrgyEOUW6uOz2PvHSR7KdatSJtfzkIhbF40DR85dYFn8MupGWcF830IaxvdeRqx+zhFFhzoNht0LwGLfqHGsUQyMcV5TM1070sUax6pNZuDcHi9NAOB8o/H5K9+awQ9tKfoTk1oPNWEjRPngjUZFukwlNwpTVevpiKSpp9UEcDSQzyXLD6TUbv0Y/asaDfo2yB9ozPxB4RxTbf4bMKXtgz6yJtmu6hsNxL5H7AgMBAAGjggJIMIICRDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUNf4wq1Iwtu2hTtj593uN4a2+quAwHwYDVR0jBBgwFoAUHy81vkYUgs1Asa55LFV4+vfUaPswMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIxLmkubGVuY3Iub3JnLzBEBgNVHREEPTA7ghZpbnRlZ3JhdGlvbnMubG9xZWQuY29tgiFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMS5jLmxlbmNyLm9yZy8yOS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgAAGl0aHC2TdbZIVXj4L3Ghrm7vOX0pfIrjFXvK3uGgHgAAAaGU3eXqAAAEAwBHMEUCIQCKrChfG4RVUy8Kp/suqQk9z3zDWpfjaQHS0437j28xvQIgSRyUMHc52kEyt2hO/x2yT8iahsWSU7VKFKGSEIuFa7AAfwBZbmwzhpSyWXKiVsig6N2QSnboCD3ahzsBCDgoFDzuWQAAAaGU3eZsAAgAAAUAGXbecwQDAEgwRgIhAKVoN8aabyItWJCrOqKTNt0qEpBs6Ooj1irv3yArILyrAiEAn8DXmfxWE/FsZBioMOOFHIJ2o1lFosHWnnrwbJGBFmkwDQYJKoZIhvcNAQELBQADggEBAEZEghbiA63425KThlZ5LQyhwRX6D+LLSrIqPb++Grz3DFEiIbQ7uNnexeSwaYXVmD1tsx0zXbSi3fDxP+KveynVLxdZQ8C78DMdAC0fk21/ZOyfwZ6v+c6HMJnaRRNFfIrFBaIdJQNsAGYhghB6zRcGqq9ye+4GnmvjNWFWAdxKZP0AUuNzxH66etPrWgDUlSJDwAsnU2dENJTQB/juN2VdIFu+bnZRDp2C5eMPHPZIX7P2sxwf2wXFmVqXCB3nKJKZuT1JJWlwwowPG0ZBpelC1ExMEBbgmTHZsebT/ILMmqPE+UkSYqsDEWNTNNGg6Td+hzUSDlUeJRKwpBSSXvA=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","integrations.loqed.com/34.155.200.196","443","OK","integrations.production.loqed.com","",""
|
||||||
|
"cert_commonName_wo_SNI","integrations.loqed.com/34.155.200.196","443","INFO","TRAEFIK DEFAULT CERT","",""
|
||||||
|
"cert_subjectAltName","integrations.loqed.com/34.155.200.196","443","INFO","integrations.loqed.com integrations.production.loqed.com","",""
|
||||||
|
"cert_trust","integrations.loqed.com/34.155.200.196","443","OK","Ok via SAN (SNI mandatory)","",""
|
||||||
|
"cert_chain_of_trust","integrations.loqed.com/34.155.200.196","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","integrations.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","integrations.loqed.com/34.155.200.196","443","OK","86 >= 30 days","",""
|
||||||
|
"cert_notBefore","integrations.loqed.com/34.155.200.196","443","INFO","2026-11-01 01:10","",""
|
||||||
|
"cert_notAfter","integrations.loqed.com/34.155.200.196","443","OK","2027-01-30 01:10","",""
|
||||||
|
"cert_extlifeSpan","integrations.loqed.com/34.155.200.196","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","integrations.loqed.com/34.155.200.196","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","integrations.loqed.com/34.155.200.196","443","INFO","http://yr1.c.lencr.org/29.crl","",""
|
||||||
|
"cert_ocspURL","integrations.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||||
|
"OCSP_stapling","integrations.loqed.com/34.155.200.196","443","INFO","not offered","",""
|
||||||
|
"cert_mustStapleExtension","integrations.loqed.com/34.155.200.196","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","integrations.loqed.com/34.155.200.196","443","LOW","--","",""
|
||||||
|
"certificate_transparency","integrations.loqed.com/34.155.200.196","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","integrations.loqed.com/34.155.200.196","443","INFO","3","",""
|
||||||
|
"certs_list_ordering_problem","integrations.loqed.com/34.155.200.196","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","integrations.loqed.com/34.155.200.196","443","INFO","YR1 (Let's Encrypt from US)","",""
|
||||||
|
"intermediate_cert <#1>","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","integrations.loqed.com/34.155.200.196","443","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","integrations.loqed.com/34.155.200.196","443","INFO","2025-09-03 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","integrations.loqed.com/34.155.200.196","443","OK","2028-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","integrations.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","integrations.loqed.com/34.155.200.196","443","INFO","YR1 <-- Root YR","",""
|
||||||
|
"intermediate_cert <#2>","integrations.loqed.com/34.155.200.196","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","integrations.loqed.com/34.155.200.196","443","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","integrations.loqed.com/34.155.200.196","443","INFO","2026-05-13 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","integrations.loqed.com/34.155.200.196","443","OK","2032-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","integrations.loqed.com/34.155.200.196","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","integrations.loqed.com/34.155.200.196","443","INFO","Root YR <-- ISRG Root X1","",""
|
||||||
|
"intermediate_cert_badOCSP","integrations.loqed.com/34.155.200.196","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","integrations.loqed.com/34.155.200.196","443","INFO","302 Found ('/')","",""
|
||||||
|
"HTTP_clock_skew","integrations.loqed.com/34.155.200.196","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","integrations.loqed.com/34.155.200.196","443","INFO","1793777307","",""
|
||||||
|
"HSTS","integrations.loqed.com/34.155.200.196","443","LOW","not offered","",""
|
||||||
|
"HPKP","integrations.loqed.com/34.155.200.196","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","integrations.loqed.com/34.155.200.196","443","INFO","nginx/1.21.6","",""
|
||||||
|
"banner_application","integrations.loqed.com/34.155.200.196","443","INFO","X-Powered-By: PHP/8.2.35","",""
|
||||||
|
"cookie_count","integrations.loqed.com/34.155.200.196","443","INFO","2 at '/' (30x detected, better try target URL of 30x)","",""
|
||||||
|
"cookie_secure","integrations.loqed.com/34.155.200.196","443","INFO","1/2 at '/' marked as secure","",""
|
||||||
|
"cookie_httponly","integrations.loqed.com/34.155.200.196","443","OK","All (2) at '/' marked as HttpOnly (30x detected, better try target URL of 30x)","",""
|
||||||
|
"Cache-Control","integrations.loqed.com/34.155.200.196","443","INFO","no-cache, private","",""
|
||||||
|
"banner_reverseproxy","integrations.loqed.com/34.155.200.196","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","integrations.loqed.com/34.155.200.196","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","integrations.loqed.com/34.155.200.196","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","integrations.loqed.com/34.155.200.196","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","integrations.loqed.com/34.155.200.196","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","integrations.loqed.com/34.155.200.196","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","integrations.loqed.com/34.155.200.196","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_X","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_15","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","integrations.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_7u25","integrations.loqed.com/34.155.200.196","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1102","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1703","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_2106","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-go_1178","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"clientsimulation-openssl_102e","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-openssl_315","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-openssl_350","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","integrations.loqed.com/34.155.200.196","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"rating_spec","integrations.loqed.com/34.155.200.196","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","integrations.loqed.com/34.155.200.196","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","integrations.loqed.com/34.155.200.196","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","30","",""
|
||||||
|
"key_exchange_score","integrations.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","27","",""
|
||||||
|
"cipher_strength_score","integrations.loqed.com/34.155.200.196","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","integrations.loqed.com/34.155.200.196","443","INFO","36","",""
|
||||||
|
"final_score","integrations.loqed.com/34.155.200.196","443","INFO","93","",""
|
||||||
|
"overall_grade","integrations.loqed.com/34.155.200.196","443","OK","A+","",""
|
||||||
|
@@ -0,0 +1,225 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 08:28:00 -->> 34.155.200.196:443 (integrations.loqed.com) <<--</span>
|
||||||
|
|
||||||
|
rDNS (34.155.200.196): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>05C73CE106F84ABAC4E6D524DA93450B2C1C (OK: length 18)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 80EDD7ED1004483BFF5FAC76EEB5BD58638464FF
|
||||||
|
SHA256 F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>integrations.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>integrations.loqed.com integrations.production.loqed.com </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN</span> (SNI mandatory)
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr1.c.lencr.org/29.crl
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>YR1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR1</i> <-- <i>Root YR</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 302 Found, redirecting to "<a href="dashboard" style="color:black;text-decoration:none;">dashboard</a>"
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">6</span>'
|
||||||
|
<span style="font-weight:bold;"> Application banner </span><span style="color:#8a7237;font-weight:bold;">X-Powered-By</span>: PHP/<span style="color:#8a7237;">8</span>.<span style="color:#8a7237;">2</span>.<span style="color:#8a7237;">3</span><span style="color:#8a7237;">5</span>'
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>2 issued: <span style="color:#008817;">1/2</span> secure, <span style="color:#008817;">2/2</span> HttpOnly -- maybe better try target URL of 30x
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Cache-Control: no-cache, private
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 08:29:06 [ 68s] -->> 34.155.200.196:443 (integrations.loqed.com) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,777 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_loqed_integrations integrations.loqed.com:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793777278",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "integrations.loqed.com",
|
||||||
|
"ip" : "34.155.200.196",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN_HTTP2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "h2"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "true"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- TLS 1.3 client determined"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "valid for 604800 seconds (>daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "05C73CE106F84ABAC4E6D524DA93450B2C1C"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "18"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "80EDD7ED1004483BFF5FAC76EEB5BD58638464FF"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFNTCCBB2gAwIBAgISBcc84Qb4SrrE5tUk2pNFCywcMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAsMSowKAYDVQQDEyFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPWD0p9X/7gALsv5hZ8dAORgWdrVJVMiDF8goE/bywu79SsUIgjHP3ydju2CM14hvVPPFbvBHNBtisztJKz22JoqMYA+06nnlGjrxwaffepVTOlbvcrgyEOUW6uOz2PvHSR7KdatSJtfzkIhbF40DR85dYFn8MupGWcF830IaxvdeRqx+zhFFhzoNht0LwGLfqHGsUQyMcV5TM1070sUax6pNZuDcHi9NAOB8o/H5K9+awQ9tKfoTk1oPNWEjRPngjUZFukwlNwpTVevpiKSpp9UEcDSQzyXLD6TUbv0Y/asaDfo2yB9ozPxB4RxTbf4bMKXtgz6yJtmu6hsNxL5H7AgMBAAGjggJIMIICRDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUNf4wq1Iwtu2hTtj593uN4a2+quAwHwYDVR0jBBgwFoAUHy81vkYUgs1Asa55LFV4+vfUaPswMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIxLmkubGVuY3Iub3JnLzBEBgNVHREEPTA7ghZpbnRlZ3JhdGlvbnMubG9xZWQuY29tgiFpbnRlZ3JhdGlvbnMucHJvZHVjdGlvbi5sb3FlZC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3lyMS5jLmxlbmNyLm9yZy8yOS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgAAGl0aHC2TdbZIVXj4L3Ghrm7vOX0pfIrjFXvK3uGgHgAAAaGU3eXqAAAEAwBHMEUCIQCKrChfG4RVUy8Kp/suqQk9z3zDWpfjaQHS0437j28xvQIgSRyUMHc52kEyt2hO/x2yT8iahsWSU7VKFKGSEIuFa7AAfwBZbmwzhpSyWXKiVsig6N2QSnboCD3ahzsBCDgoFDzuWQAAAaGU3eZsAAgAAAUAGXbecwQDAEgwRgIhAKVoN8aabyItWJCrOqKTNt0qEpBs6Ooj1irv3yArILyrAiEAn8DXmfxWE/FsZBioMOOFHIJ2o1lFosHWnnrwbJGBFmkwDQYJKoZIhvcNAQELBQADggEBAEZEghbiA63425KThlZ5LQyhwRX6D+LLSrIqPb++Grz3DFEiIbQ7uNnexeSwaYXVmD1tsx0zXbSi3fDxP+KveynVLxdZQ8C78DMdAC0fk21/ZOyfwZ6v+c6HMJnaRRNFfIrFBaIdJQNsAGYhghB6zRcGqq9ye+4GnmvjNWFWAdxKZP0AUuNzxH66etPrWgDUlSJDwAsnU2dENJTQB/juN2VdIFu+bnZRDp2C5eMPHPZIX7P2sxwf2wXFmVqXCB3nKJKZuT1JJWlwwowPG0ZBpelC1ExMEBbgmTHZsebT/ILMmqPE+UkSYqsDEWNTNNGg6Td+hzUSDlUeJRKwpBSSXvA=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "integrations.production.loqed.com"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TRAEFIK DEFAULT CERT"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "integrations.loqed.com integrations.production.loqed.com"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN (SNI mandatory)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "86 >= 30 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-11-01 01:10"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-30 01:10"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://yr1.c.lencr.org/29.crl"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "3"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YR1 (Let's Encrypt from US)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-09-03 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2028-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YR1 <-- Root YR"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-05-13 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2032-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Root YR <-- ISRG Root X1"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "302 Found ('/')"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793777307"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "nginx/1.21.6"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "X-Powered-By: PHP/8.2.35"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2 at '/' (30x detected, better try target URL of 30x)"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_secure",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1/2 at '/' marked as secure"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_httponly",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "All (2) at '/' marked as HttpOnly (30x detected, better try target URL of 30x)"
|
||||||
|
},{
|
||||||
|
"id" : "Cache-Control",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no-cache, private"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 68
|
||||||
|
}
|
||||||
@@ -0,0 +1,204 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_loqed_integrations integrations.loqed.com:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 08:28:00 -->> 34.155.200.196:443 (integrations.loqed.com) <<--[m
|
||||||
|
|
||||||
|
rDNS (34.155.200.196): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets no, ID: yes
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication
|
||||||
|
[1m Serial [m05C73CE106F84ABAC4E6D524DA93450B2C1C (OK: length 18)
|
||||||
|
[1m Fingerprints [mSHA1 80EDD7ED1004483BFF5FAC76EEB5BD58638464FF
|
||||||
|
SHA256 F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
|
||||||
|
[1m Common Name (CN) [m[3mintegrations.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||||
|
[1m subjectAltName (SAN) [m[3mintegrations.loqed.com integrations.production.loqed.com [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN[m (SNI mandatory)
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [mhttp://yr1.c.lencr.org/29.crl
|
||||||
|
[1m OCSP URI [m--
|
||||||
|
[1m OCSP stapling [mnot offered
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 3
|
||||||
|
[1m Issuer [m[3mYR1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR1[m <-- [3mRoot YR[m
|
||||||
|
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 302 Found, redirecting to "dashboard"
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m1(B[m.[33m6(B[m
|
||||||
|
[1m Application banner [m[33m[1mX-Powered-By(B[m: PHP/[33m8(B[m.[33m2(B[m.[33m3(B[m[33m5(B[m
|
||||||
|
[1m Cookie(s) [m2 issued: [0;32m1/2[m secure, [0;32m2/2[m HttpOnly -- maybe better try target URL of 30x
|
||||||
|
[1m Security headers [mCache-Control: no-cache, private
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=F0340D8771A6E66A177CCAAB9CEEAEDE57DB21D1ECA28082093F2E13799FA962
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 08:29:06 [ 68s] -->> 34.155.200.196:443 (integrations.loqed.com) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,159 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","mqtt.production.loqed.com/34.155.200.196","8883","DEBUG","Couldn't determine service, skipping all HTTP checks","",""
|
||||||
|
"pre_128cipher","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","",""
|
||||||
|
"SSLv3","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","",""
|
||||||
|
"TLS1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||||
|
"TLS1_1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||||
|
"TLS1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||||
|
"TLS1_3","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered with final","",""
|
||||||
|
"NPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||||
|
"ALPN_HTTP2","mqtt.production.loqed.com/34.155.200.196","8883","OK","h2","",""
|
||||||
|
"ALPN","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","mqtt.production.loqed.com/34.155.200.196","8883","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","mqtt.production.loqed.com/34.155.200.196","8883","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||||
|
"cipher-tls1_2_xc02f","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc013","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc014","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9c","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x9d","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x2f","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x35","mqtt.production.loqed.com/34.155.200.196","8883","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","true","",""
|
||||||
|
"cipher_order-tls1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_3_x1302","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","mqtt.production.loqed.com/34.155.200.196","8883","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_3","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher_order","mqtt.production.loqed.com/34.155.200.196","8883","OK","server -- TLS 1.3 client determined","",""
|
||||||
|
"FS","mqtt.production.loqed.com/34.155.200.196","8883","OK","offered","",""
|
||||||
|
"FS_ciphers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"FS_KEMs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","mqtt.production.loqed.com/34.155.200.196","8883","OK","prime256v1 secp384r1 secp521r1 X25519","",""
|
||||||
|
"FS_TLS12_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","LOW","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1","",""
|
||||||
|
"FS_TLS13_sig_algs","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||||
|
"TLS_extensions","mqtt.production.loqed.com/34.155.200.196","8883","INFO","'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","mqtt.production.loqed.com/34.155.200.196","8883","LOW","valid for 604800 seconds (>daily)","",""
|
||||||
|
"SSL_sessionID_support","mqtt.production.loqed.com/34.155.200.196","8883","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","",""
|
||||||
|
"sessionresumption_ID","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","mqtt.production.loqed.com/34.155.200.196","8883","INFO","random","",""
|
||||||
|
"certificate_compression","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","",""
|
||||||
|
"clientAuth","mqtt.production.loqed.com/34.155.200.196","8883","INFO","none","",""
|
||||||
|
"cert_numbers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","mqtt.production.loqed.com/34.155.200.196","8883","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","mqtt.production.loqed.com/34.155.200.196","8883","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLS Web Server Authentication","",""
|
||||||
|
"cert_serialNumber","mqtt.production.loqed.com/34.155.200.196","8883","INFO","06E81D5B9CC230FE76507D0EA12EE2BF2BE6","",""
|
||||||
|
"cert_serialNumberLen","mqtt.production.loqed.com/34.155.200.196","8883","INFO","18","",""
|
||||||
|
"cert_fingerprintSHA1","mqtt.production.loqed.com/34.155.200.196","8883","INFO","A5D4BB82B189F9E7924595FFCF31411019B6087F","",""
|
||||||
|
"cert_fingerprintSHA256","mqtt.production.loqed.com/34.155.200.196","8883","INFO","AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","",""
|
||||||
|
"cert","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","mqtt.production.loqed.com/34.155.200.196","8883","OK","mqtt.production.loqed.com","",""
|
||||||
|
"cert_commonName_wo_SNI","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TRAEFIK DEFAULT CERT","",""
|
||||||
|
"cert_subjectAltName","mqtt.production.loqed.com/34.155.200.196","8883","INFO","mqtt.production.loqed.com","",""
|
||||||
|
"cert_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","Ok via SAN and CN (SNI mandatory)","",""
|
||||||
|
"cert_chain_of_trust","mqtt.production.loqed.com/34.155.200.196","8883","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","",""
|
||||||
|
"cert_expirationStatus","mqtt.production.loqed.com/34.155.200.196","8883","OK","86 >= 30 days","",""
|
||||||
|
"cert_notBefore","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-11-01 01:10","",""
|
||||||
|
"cert_notAfter","mqtt.production.loqed.com/34.155.200.196","8883","OK","2027-01-30 01:10","",""
|
||||||
|
"cert_extlifeSpan","mqtt.production.loqed.com/34.155.200.196","8883","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","mqtt.production.loqed.com/34.155.200.196","8883","INFO","http://yr1.c.lencr.org/103.crl","",""
|
||||||
|
"cert_ocspURL","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","",""
|
||||||
|
"OCSP_stapling","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not offered","",""
|
||||||
|
"cert_mustStapleExtension","mqtt.production.loqed.com/34.155.200.196","8883","INFO","--","",""
|
||||||
|
"DNS_CAArecord","mqtt.production.loqed.com/34.155.200.196","8883","LOW","--","",""
|
||||||
|
"certificate_transparency","mqtt.production.loqed.com/34.155.200.196","8883","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","mqtt.production.loqed.com/34.155.200.196","8883","INFO","3","",""
|
||||||
|
"certs_list_ordering_problem","mqtt.production.loqed.com/34.155.200.196","8883","INFO","no","",""
|
||||||
|
"cert_caIssuers","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 (Let's Encrypt from US)","",""
|
||||||
|
"intermediate_cert <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2025-09-03 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2028-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","YR1 <-- Root YR","",""
|
||||||
|
"intermediate_cert <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","2026-05-13 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","2032-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","mqtt.production.loqed.com/34.155.200.196","8883","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Root YR <-- ISRG Root X1","",""
|
||||||
|
"intermediate_cert_badOCSP","mqtt.production.loqed.com/34.155.200.196","8883","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"heartbleed","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","mqtt.production.loqed.com/34.155.200.196","8883","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310"
|
||||||
|
"POODLE_SSL","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","mqtt.production.loqed.com/34.155.200.196","8883","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","mqtt.production.loqed.com/34.155.200.196","8883","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","mqtt.production.loqed.com/34.155.200.196","8883","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","mqtt.production.loqed.com/34.155.200.196","8883","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","mqtt.production.loqed.com/34.155.200.196","8883","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_X","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_15","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_7u25","mqtt.production.loqed.com/34.155.200.196","8883","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1102","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1703","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_2106","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-go_1178","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"clientsimulation-openssl_102e","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-openssl_315","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-openssl_350","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","mqtt.production.loqed.com/34.155.200.196","8883","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"rating_spec","mqtt.production.loqed.com/34.155.200.196","8883","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","mqtt.production.loqed.com/34.155.200.196","8883","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","30","",""
|
||||||
|
"key_exchange_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","27","",""
|
||||||
|
"cipher_strength_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","mqtt.production.loqed.com/34.155.200.196","8883","INFO","36","",""
|
||||||
|
"final_score","mqtt.production.loqed.com/34.155.200.196","8883","INFO","93","",""
|
||||||
|
"overall_grade","mqtt.production.loqed.com/34.155.200.196","8883","OK","A+","",""
|
||||||
|
@@ -0,0 +1,212 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--</span>
|
||||||
|
|
||||||
|
rDNS (34.155.200.196): --
|
||||||
|
Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 <span style="color:#a86437;">RSA+SHA1</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>604800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
|
||||||
|
SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>mqtt.production.loqed.com </i> (CN in response to request w/o SNI: <i>TRAEFIK DEFAULT CERT </i>)
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>mqtt.production.loqed.com </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (SNI mandatory)
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">86 >= 30 days</span> (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>http://yr1.c.lencr.org/103.crl
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>YR1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YR1</i> <-- <i>Root YR</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YR</i> <-- <i>ISRG Root X1</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span> (not using HTTP anyway)
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
Could not determine the protocol, only simulating generic clients.
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,722 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793776604",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "mqtt.production.loqed.com",
|
||||||
|
"ip" : "34.155.200.196",
|
||||||
|
"port" : "8883",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "Couldn't determine service, skipping all HTTP checks",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN_HTTP2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "h2"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA AES256-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "true"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- TLS 1.3 client determined"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA1"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'EC point formats/#11' 'application layer protocol negotiation/#16' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "valid for 604800 seconds (>daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "06E81D5B9CC230FE76507D0EA12EE2BF2BE6"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "18"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "A5D4BB82B189F9E7924595FFCF31411019B6087F"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFDTCCA/WgAwIBAgISBugdW5zCMP52UH0OoS7ivyvmMA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjEwHhcNMjYxMTAxMDExMDIyWhcNMjcwMTMwMDExMDIxWjAkMSIwIAYDVQQDExltcXR0LnByb2R1Y3Rpb24ubG9xZWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1g9KfV/+4AC7L+YWfHQDkYFna1SVTIgxfIKBP28sLu/UrFCIIxz98nY7tgjNeIb1TzxW7wRzQbYrM7SSs9tiaKjGAPtOp55Ro68cGn33qVUzpW73K4MhDlFurjs9j7x0keynWrUibX85CIWxeNA0fOXWBZ/DLqRlnBfN9CGsb3Xkasfs4RRYc6DYbdC8Bi36hxrFEMjHFeUzNdO9LFGseqTWbg3B4vTQDgfKPx+SvfmsEPbSn6E5NaDzVhI0T54I1GRbpMJTcKU1Xr6YikqafVBHA0kM8lyw+k1G79GP2rGg36NsgfaMz8QeEcU23+GzCl7YM+sibZruobDcS+R+wIDAQABo4ICKDCCAiQwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDX+MKtSMLbtoU7Y+fd7jeGtvqrgMB8GA1UdIwQYMBaAFB8vNb5GFILNQLGueSxVePr31Gj7MDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3lyMS5pLmxlbmNyLm9yZy8wJAYDVR0RBB0wG4IZbXF0dC5wcm9kdWN0aW9uLmxvcWVkLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8veXIxLmMubGVuY3Iub3JnLzEwMy5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAdQBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaGU3edZAAAEAwBGMEQCIF5xX61Rw9ZKA3Mxl3XTHR18zCilvy0X/zv+lKyC+Fi7AiA8LgakeVEaGo2DcJR37VPJ7qXgmgJ6EBbRi4SmS9DltgB/AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoZTd55wACAAABQA0fcNvBAMASDBGAiEA9KhKX7lvZdo6Dmzzu9AiTPryUoP5rW4M+grxbzJnQhgCIQDkLjYdxe63N4ypdzyedv2t9mDJI8pWhb/+bo8vvFdQuzANBgkqhkiG9w0BAQsFAAOCAQEANNwZiyVtp5/txLg8Lz6vlLQt6pSFWCGd//kXOkINw7GjtwiMjA4/9p1iBM9NrwHmKOQDx5bY6w/+oXFdgSkNDJ/Wz6pfNugaigoZrnSUFqGb/9E0seIaFcvG5hkcKV7gOszPZTfiQxeHW3N/GcgSiiJkJ7BiQ5pKaZ1Kl6Qfl3DtqhwJECE7zRNWHvQJnLXGLwnaPK4UyhGvQ2NQEtNCQPqlaVkRt9M5MM+HDAYNQMEgU0uqadmsRbsY9dwNguBK1z6u8wuq7+gDxyJgsuc55B3LKidus70w7QaywDxL6ustggCPn853hSAo8CnLTZxNQKsVCAFrX0P2IcQ/g5RWgA==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "mqtt.production.loqed.com"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TRAEFIK DEFAULT CERT"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "mqtt.production.loqed.com"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN and CN (SNI mandatory)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "86 >= 30 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-11-01 01:10"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-30 01:10"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://yr1.c.lencr.org/103.crl"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "3"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YR1 (Let's Encrypt from US)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIE2zCCAsOgAwIBAgIRAKICU/FfJpHAXcHOE7m8yk4wDQYJKoZIhvcNAQELBQAwLjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIwHhcNMjUwOTAzMDAwMDAwWhcNMjgwOTAyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEMMAoGA1UEAxMDWVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoVi8X2xCYgMXvJxNPKp/oF13UMgmPABB07VCLNDtoXmt9luEZNJSBV10VyT1Pz6LD8Zq1d2gc43WNl1AdRrj4sEnazbOiz0nPpmGBp2hui49oZtDIY6wdKeZAi5BbNU20CH6RSBBMLSQ9cXrH8dxdv4PAJ45ssGML68USE3BsjC2a6cAN9L5CgXVIQi5tfNiTPoFZZ3S0OlXqLmmtdV95udWAb5b6e/F49DiCsH0Y00Ag72BVIb1hzynmKe+X0mERBTtsb3BwmpV9ipeBjMLoR/D9cHxHQCWoi5lTmXwY015J5rGelz1nZjJuxc2kioaX29XJBnhMkP531rSdG5uMwIDAQABo4HuMIHrMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQfLzW+RhSCzUCxrnksVXj699Ro+zAfBgNVHSMEGDAWgBTe51tg0CJtQCh9Pw0B/qS1UrRRlDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly95ci5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3lyLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEA0+zvMq3kHig1ddTmmm+RibTr9/RpX7k4buanMMRqbV/yIvP82zAHN3mvaw+cASuVsdpd0ikjhr4hnhJQLQOzOp2ccKrsdGOAgo0vddeISFAqEWEV4lmUM3vFF796up+bSgmJ1u6RupDCMxDgF8M3eLvGuj6L0lu3zkQ0KuQLnKxLtB0oQqn1Idg5CuuGpMvQzk29Pa3D/qHurc0EIM9SxukQuJqq63lxsYyRQFU8yMBOhq1w5LbfaWNRrz1uklOfI/pYkAb2E2MTZrAMQkBIE2S8Jt1F8gRc96o/xOsrgvSka84AisX6xq1lz1Z7jGvrnXc4TMcjxZTjiTaihcYI1JIXZiLtEMSCa5l3cu8YWd6zdLRQlqRdclVjuQfNHawRJ6GWlkK0QJosivTKwdBw3KxEtzGo8yMHERbsy57gP1UXHOMcmZYQC0gtyR3SxfenIM/MxC3Ia2Ypab/kQ/CTnlIn2KQ5JUC6NYrGCbhFN9bp5lKJStEwCUnLpntcrXk5XVDCNv/5RyWpRThkGOV7GetKkQ0qAY8hCzWK6oqnAhDZcjlYVdWfqOw3DIOX6EDNBgAqHarRVxyF9QZdOaXSyPJ0ueD2BYJEBgaCGQ8rAaU/Qc123V5LTXDZW4CcsPBDyhy4v+c8hClAyw/IkJlfBqxB9D+/wvIMHgECZ4ptP6o=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "13949634D99CD6FD6AA80BC034FEFACCEB1969FEEF986586713ECDBB05758D3F"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-09-03 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2028-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YR1 <-- Root YR"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF9DCCA9ygAwIBAgIRAPJLbRf52a18scn+p4eCaZ8wDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGgYbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBNJAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBznZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawTvSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEatnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lzYal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/BAgMBAAGjgeswgegwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFN7nW2DQIm1AKH0/DQH+pLVStFGUMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQA8spSI95KKfn2W6GMmDpHBJSPaLbsS3W93cijJCRCYAc1fsJgL1FIL7C0C9ecPOdcwB2fi0Dk2p94j9iTJCxmt5CFSKLRWwnXT2MMSXexVxqoVB79BdWPxVXETkVme/qYSAuKVHh5Ps+5BixgmwS1JkjSAc+MfrUbNssVEEnH0aEiAh+rotXAVJSP/Ye7LJPEwD9DWG72vVWbhAcuOf5OLjz57Ctk7MgQHynZ7+PlHJtajroCaIbtCr6tcZZaAwUQm+jQyeWdV+2hv9deOYFmKeQyjjcSrN5Nadrw+L9DZJLbA1HqeNvLhBgqpP0fvJq2N6EtD574N6eMI7uMsJTnji2UDz9el5XLSv9fqJMuDQtYVb2oTNoKpoUqhxPVC0aq4eG5MESaIdn8b5ZGSSeAJLMHXljEdlNza+ncfkviXk1POLnnFdvx8/gk6M374WbLWFXw8N141B/Rl/tINGfl1TxOIiqtiMYkL02RSGb1kq34BL9NPP27zRGMuHGnzS3hFIrRTfKxrzUZ9RzQWzEG3K6fJ3r2nqSltkeytis9DIBoFY9VmVyjLM71DMi+y1+TRSJVClEMwvA4yL++7q9XZx5r5wBRWB4kQTKH5qyoZnDw7iiuh1lIDyDFx8r7i9vIJU5HS3moZLkYWAOilMaV9N56A9Bgb6dNcHkvg3NoaYA==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "072639D0B140D5BFFAE16AD9C3F6CC6086040621F51EE61A6D46A8915C07CF76"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-05-13 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2032-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Root YR <-- ISRG Root X1"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not applicable, not HTTP"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable (not using HTTP anyway)"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 64
|
||||||
|
}
|
||||||
@@ -0,0 +1,191 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_loqed_mqtt mqtt.production.loqed.com:8883"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 08:16:45 -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--[m
|
||||||
|
|
||||||
|
rDNS (34.155.200.196): --
|
||||||
|
Service detected: Couldn't determine what's running on port 8883, assuming no HTTP service => skipping all HTTP checks
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 [1;33mRSA+SHA1[m
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"session ticket/#35" "supported versions/#43" "key share/#51"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m604800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets no, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication
|
||||||
|
[1m Serial [m06E81D5B9CC230FE76507D0EA12EE2BF2BE6 (OK: length 18)
|
||||||
|
[1m Fingerprints [mSHA1 A5D4BB82B189F9E7924595FFCF31411019B6087F
|
||||||
|
SHA256 AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||||
|
[1m Common Name (CN) [m[3mmqtt.production.loqed.com [m (CN in response to request w/o SNI: [3mTRAEFIK DEFAULT CERT [m)
|
||||||
|
[1m subjectAltName (SAN) [m[3mmqtt.production.loqed.com [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (SNI mandatory)
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m86 >= 30 days[m (2026-11-01 01:10 --> 2027-01-30 01:10)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [mhttp://yr1.c.lencr.org/103.crl
|
||||||
|
[1m OCSP URI [m--
|
||||||
|
[1m OCSP stapling [mnot offered
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 3
|
||||||
|
[1m Issuer [m[3mYR1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYR1[m <-- [3mRoot YR[m
|
||||||
|
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YR[m <-- [3mISRG Root X1[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m (not using HTTP anyway)
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=AC51419B342B08BC9A2B8430EA3887451B822F69B549D045705EFFDB0AF0701A
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
Could not determine the protocol, only simulating generic clients.
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 08:17:48 [ 64s] -->> 34.155.200.196:8883 (mqtt.production.loqed.com) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,174 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","",""
|
||||||
|
"SSLv3","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","",""
|
||||||
|
"TLS1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||||
|
"TLS1_3","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered + downgraded to weaker protocol","",""
|
||||||
|
"NPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||||
|
"ALPN","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||||
|
"cipherlist_STRONG_FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_2_xc02c","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca9","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc02b","changelog-backend.shelly.cloud/34.62.47.252","443","OK","TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"cipher_order","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","NOT a server cipher order configured","",""
|
||||||
|
"FS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","offered","",""
|
||||||
|
"FS_ciphers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","changelog-backend.shelly.cloud/34.62.47.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||||
|
"FS_TLS12_sig_algs","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224","",""
|
||||||
|
"TLS_extensions","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no -- no lifetime advertised","",""
|
||||||
|
"SSL_sessionID_support","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","",""
|
||||||
|
"sessionresumption_ID","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","random","",""
|
||||||
|
"cert_compression","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","N/A","",""
|
||||||
|
"clientAuth","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","none","",""
|
||||||
|
"cert_numbers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ECDSA with SHA384","",""
|
||||||
|
"cert_keySize","changelog-backend.shelly.cloud/34.62.47.252","443","OK","EC 256 bits (curve P-256)","",""
|
||||||
|
"cert_keyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Digital Signature","",""
|
||||||
|
"cert_extKeyUsage","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS Web Server Authentication","",""
|
||||||
|
"cert_serialNumber","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0582918DB89B4A8A742D84FD104CDC41D76B","",""
|
||||||
|
"cert_serialNumberLen","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","18","",""
|
||||||
|
"cert_fingerprintSHA1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2B1B2A1E33BDD140FA382D85F749503A2CEB16FD","",""
|
||||||
|
"cert_fingerprintSHA256","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF","",""
|
||||||
|
"cert","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","changelog-backend.shelly.cloud/34.62.47.252","443","OK","changelog-backend.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","changelog-backend.shelly.cloud","",""
|
||||||
|
"cert_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","Ok via SAN and CN (works w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","changelog-backend.shelly.cloud/34.62.47.252","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","changelog-backend.shelly.cloud/34.62.47.252","443","OK","46 >= 30 days","",""
|
||||||
|
"cert_notBefore","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-09-21 09:03","",""
|
||||||
|
"cert_notAfter","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2026-12-20 09:03","",""
|
||||||
|
"cert_extlifeSpan","changelog-backend.shelly.cloud/34.62.47.252","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","http://ye1.c.lencr.org/108.crl","",""
|
||||||
|
"cert_ocspURL","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","",""
|
||||||
|
"OCSP_stapling","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","not offered","",""
|
||||||
|
"cert_mustStapleExtension","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","changelog-backend.shelly.cloud/34.62.47.252","443","LOW","--","",""
|
||||||
|
"certificate_transparency","changelog-backend.shelly.cloud/34.62.47.252","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 (Let's Encrypt from US)","",""
|
||||||
|
"intermediate_cert <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2025-09-03 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2028-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","YE1 <-- Root YE","",""
|
||||||
|
"intermediate_cert <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","Root YE <-- ISRG Root X2","",""
|
||||||
|
"intermediate_cert <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","2026-05-13 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","2032-09-02 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","ISRG Root X2 <-- ISRG Root X1","",""
|
||||||
|
"intermediate_cert_badOCSP","changelog-backend.shelly.cloud/34.62.47.252","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","404 Not Found ('/')","",""
|
||||||
|
"HTTP_clock_skew","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","1793780149","",""
|
||||||
|
"HSTS_time","changelog-backend.shelly.cloud/34.62.47.252","443","OK","180 days (=15552000 seconds) > 15552000 seconds","",""
|
||||||
|
"HSTS_subdomains","changelog-backend.shelly.cloud/34.62.47.252","443","OK","includes subdomains","",""
|
||||||
|
"HSTS_preload","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","domain is NOT marked for preloading","",""
|
||||||
|
"HPKP","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||||
|
"banner_application","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No application banner found","",""
|
||||||
|
"cookie_count","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||||
|
"X-Frame-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","SAMEORIGIN","",""
|
||||||
|
"X-Content-Type-Options","changelog-backend.shelly.cloud/34.62.47.252","443","OK","nosniff","",""
|
||||||
|
"Content-Security-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","OK","default-src 'none'","",""
|
||||||
|
"Cross-Origin-Opener-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","",""
|
||||||
|
"Cross-Origin-Resource-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","same-origin","",""
|
||||||
|
"Cross-Origin-Embedder-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","require-corp","",""
|
||||||
|
"X-XSS-Protection","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","0","",""
|
||||||
|
"Access-Control-Allow-Origin","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","*","",""
|
||||||
|
"Referrer-Policy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no-referrer","",""
|
||||||
|
"banner_reverseproxy","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","changelog-backend.shelly.cloud/34.62.47.252","443","MEDIUM","potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","no RSA certificate, can't be used with SSLv2 elsewhere","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","changelog-backend.shelly.cloud/34.62.47.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","changelog-backend.shelly.cloud/34.62.47.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_X","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_15","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_win81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_15_win10","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_7u25","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_1102","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_1703","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_2106","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-go_1178","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305","",""
|
||||||
|
"clientsimulation-openssl_102e","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_111d","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256","",""
|
||||||
|
"rating_spec","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","",""
|
||||||
|
"key_exchange_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","100","",""
|
||||||
|
"key_exchange_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","30","",""
|
||||||
|
"cipher_strength_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","36","",""
|
||||||
|
"final_score","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","96","",""
|
||||||
|
"overall_grade","changelog-backend.shelly.cloud/34.62.47.252","443","OK","A-","",""
|
||||||
|
"grade_cap_warning_1","changelog-backend.shelly.cloud/34.62.47.252","443","INFO","TLS 1.3 is not supported","",""
|
||||||
|
@@ -0,0 +1,224 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (34.62.47.252): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span>not offered and downgraded to a weaker protocol
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||||
|
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||||
|
<u>TLSv1.3</u>
|
||||||
|
-
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||||
|
<span style="color:#cd00cd;"> -- inconclusive test, matching cipher in list missing</span>, better see above
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ECDSA-AES128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">ECDSA with SHA384</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>EC <span style="color:#008817;">256</span> bits (curve P-256)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
|
||||||
|
SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>changelog-backend.shelly.cloud </i> (CN in response to request w/o SNI: <i>*.shelly.cloud </i>)
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>changelog-backend.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (works w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">46 >= 30 days</span> (2026-09-21 09:03 --> 2026-12-20 09:03)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>http://ye1.c.lencr.org/108.crl
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>YE1</i> (<i>Let's Encrypt</i> from <i>US</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2028-09-02 23:59). <i>YE1</i> <-- <i>Root YE</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>Root YE</i> <-- <i>ISRG Root X2</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2032-09-02 23:59). <i>ISRG Root X2</i> <-- <i>ISRG Root X1</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#008817;">180 days</span>=15552000 s<span style="color:#008817;">, includeSubDomains</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span><span style="color:#008817;">X-Frame-Options</span>: SAMEORIGIN
|
||||||
|
<span style="color:#008817;">X-Content-Type-Options</span>: nosniff
|
||||||
|
<span style="color:#008817;">Content-Security-Policy</span>: default-src 'none'
|
||||||
|
Cross-Origin-Opener-Policy: same-origin
|
||||||
|
Cross-Origin-Resource-Policy: same-origin
|
||||||
|
Cross-Origin-Embedder-Policy: require-corp
|
||||||
|
X-XSS-Protection: 0
|
||||||
|
Access-Control-Allow-Origin: *
|
||||||
|
Referrer-Policy: no-referrer
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#c05600;">potentially NOT ok, "gzip" HTTP compression detected.</span> - only supplied "/" tested
|
||||||
|
Can be ignored for static pages or if no secrets in the page
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span> - ARIA, CHACHA or CCM ciphers found
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>96
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A-</span>
|
||||||
|
<span style="font-weight:bold;"> Grade warning </span><span style="color:#c05600;">TLS 1.3 is not supported</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,785 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793780130",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "changelog-backend.shelly.cloud",
|
||||||
|
"ip" : "34.62.47.252",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered + downgraded to weaker protocol"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca9",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02b",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a server cipher order configured"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no -- no lifetime advertised"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "cert_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "N/A"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ECDSA with SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "EC 256 bits (curve P-256)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0582918DB89B4A8A742D84FD104CDC41D76B"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "18"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2B1B2A1E33BDD140FA382D85F749503A2CEB16FD"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIDqjCCAzGgAwIBAgISBYKRjbibSop0LYT9EEzcQddrMAoGCCqGSM49BAMDMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwHhcNMjYwOTIxMDkwMzIzWhcNMjYxMjIwMDkwMzIyWjApMScwJQYDVQQDEx5jaGFuZ2Vsb2ctYmFja2VuZC5zaGVsbHkuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQQ8NWobRGCZnVgvB+IiEJGBVpOLBTID9SCcQMzLlJbYG2gW2ZtbxIUgCdMdObg1eaSADMRMXg3SeWCHfrv8sRQo4ICLTCCAikwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFODnHvjJOu/f0eaxHjdPLbwceJKJMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wKQYDVR0RBCIwIIIeY2hhbmdlbG9nLWJhY2tlbmQuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA4LmNybDCCAQwGCisGAQQB1nkCBAIEgf0EgfoA+AB2AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABoMNqOaoAAAQDAEcwRQIhANOOfQe8239n05pd0jaHqLM33LklhffVhuZcD6oCm8wjAiBZ7gZq/iEggyANAFhxaX8KWQ7yczQaYe8J/8shI/a1pgB+AI7KRwus3mrzogawpHqEt0b+H8a/lT4l5ptO5AJI88boAAABoMNqQZUACAAABQARYBLnBAMARzBFAiAJgSV4ag6FeBW/ErbnK8KBq+ojfagZ57qJkdyGe0qMUAIhAKOApX1/N4fW9tPrEa2T0L1CWroE9CledtCBqukV0t5EMAoGCCqGSM49BAMDA2cAMGQCMAITDwiKB9nd9lnImuFqychVtyn8J5mgAhOEFuhY60vDfbfPtYcFMAhk6KCh2SRPYQIwLLNCPjchbDr0Or+Lfd8BSY+K6UodoVJvJcQhFr/CXD3XbE7HFovr46YBlH4iRldO\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "changelog-backend.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "changelog-backend.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN and CN (works w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "46 >= 30 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-09-21 09:03"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2026-12-20 09:03"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ye1.c.lencr.org/108.crl"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YE1 (Let's Encrypt from US)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0yNTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+zASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9xteIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqjjDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5sZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgfZwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/LVKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "A2372D06431E9716365EEED47EC020351497D182FCC038E457E58168A03CAC07"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-09-03 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2028-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "YE1 <-- Root YE"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcNMzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKWrt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMDaQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYKAx54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC26hSW1/IWaas6dg==\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0FC0901CCA2BAE9E9FDBB02D50D02F1094F7B36672086991B9E897626DC485F0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-05-13 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2032-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Root YE <-- ISRG Root X2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBaFw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQADggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0UfoshMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWcMS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlVpcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZcEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+pTT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "EE5F7ABD6981BB0255632CD8F49283451B4B18844D12040B44EE00F07B8FE2C6"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-05-13 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2032-09-02 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ISRG Root X2 <-- ISRG Root X1"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "404 Not Found ('/')"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793780149"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS_time",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "180 days (=15552000 seconds) > 15552000 seconds"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS_subdomains",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "includes subdomains"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS_preload",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "domain is NOT marked for preloading"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "X-Frame-Options",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SAMEORIGIN"
|
||||||
|
},{
|
||||||
|
"id" : "X-Content-Type-Options",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "nosniff"
|
||||||
|
},{
|
||||||
|
"id" : "Content-Security-Policy",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "default-src 'none'"
|
||||||
|
},{
|
||||||
|
"id" : "Cross-Origin-Opener-Policy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "same-origin"
|
||||||
|
},{
|
||||||
|
"id" : "Cross-Origin-Resource-Policy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "same-origin"
|
||||||
|
},{
|
||||||
|
"id" : "Cross-Origin-Embedder-Policy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "require-corp"
|
||||||
|
},{
|
||||||
|
"id" : "X-XSS-Protection",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0"
|
||||||
|
},{
|
||||||
|
"id" : "Access-Control-Allow-Origin",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*"
|
||||||
|
},{
|
||||||
|
"id" : "Referrer-Policy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no-referrer"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "no session ticket extension"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "MEDIUM",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no RSA certificate, can't be used with SSLv2 elsewhere"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "96"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A-"
|
||||||
|
},{
|
||||||
|
"id" : "grade_cap_warning_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS 1.3 is not supported"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 46
|
||||||
|
}
|
||||||
@@ -0,0 +1,203 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_changelog changelog-backend.shelly.cloud:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 09:15:32 -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (34.62.47.252): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [mnot offered and downgraded to a weaker protocol
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||||
|
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||||
|
[4mTLSv1.3[m
|
||||||
|
-
|
||||||
|
|
||||||
|
[1m Has server cipher order? [mno
|
||||||
|
[0;35m -- inconclusive test, matching cipher in list missing[m, better see above
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ECDSA-AES128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mECDSA+SHA512 ECDSA+SHA384 ECDSA+SHA256 ECDSA+SHA224
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets no, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mECDSA with SHA384[m
|
||||||
|
[1m Server key size [mEC [0;32m256[m bits (curve P-256)
|
||||||
|
[1m Server key usage [mDigital Signature
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication
|
||||||
|
[1m Serial [m0582918DB89B4A8A742D84FD104CDC41D76B (OK: length 18)
|
||||||
|
[1m Fingerprints [mSHA1 2B1B2A1E33BDD140FA382D85F749503A2CEB16FD
|
||||||
|
SHA256 E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||||
|
[1m Common Name (CN) [m[3mchangelog-backend.shelly.cloud [m (CN in response to request w/o SNI: [3m*.shelly.cloud [m)
|
||||||
|
[1m subjectAltName (SAN) [m[3mchangelog-backend.shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (works w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=E619D0A43C9A1D858630CAD4E88265B0818EE3DFA4F706AEE7B740C48C4EA1EF
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m46 >= 30 days[m (2026-09-21 09:03 --> 2026-12-20 09:03)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [mhttp://ye1.c.lencr.org/108.crl
|
||||||
|
[1m OCSP URI [m--
|
||||||
|
[1m OCSP stapling [mnot offered
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mYE1[m ([3mLet's Encrypt[m from [3mUS[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2028-09-02 23:59). [3mYE1[m <-- [3mRoot YE[m
|
||||||
|
#2: [0;32mok > 40 days[m (2032-09-02 23:59). [3mRoot YE[m <-- [3mISRG Root X2[m
|
||||||
|
#3: [0;32mok > 40 days[m (2032-09-02 23:59). [3mISRG Root X2[m <-- [3mISRG Root X1[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[0;32m180 days[m=15552000 s[0;32m, includeSubDomains[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||||
|
[1m Security headers [m[0;32mX-Frame-Options[m: SAMEORIGIN
|
||||||
|
[0;32mX-Content-Type-Options[m: nosniff
|
||||||
|
[0;32mContent-Security-Policy[m: default-src 'none'
|
||||||
|
Cross-Origin-Opener-Policy: same-origin
|
||||||
|
Cross-Origin-Resource-Policy: same-origin
|
||||||
|
Cross-Origin-Embedder-Policy: require-corp
|
||||||
|
X-XSS-Protection: 0
|
||||||
|
Access-Control-Allow-Origin: *
|
||||||
|
Referrer-Policy: no-referrer
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||||
|
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;33mpotentially NOT ok, "gzip" HTTP compression detected.[m - only supplied "/" tested
|
||||||
|
Can be ignored for static pages or if no secrets in the page
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
no RSA certificate, thus certificate can't be used with SSLv2 elsewhere
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m - ARIA, CHACHA or CCM ciphers found
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-ECDSA-CHACHA20-POLY1305 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 100 (30)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m96
|
||||||
|
[1m Overall Grade [m[1;32mA-[m
|
||||||
|
[1m Grade warning [m[0;33mTLS 1.3 is not supported[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 09:16:16 [ 46s] -->> 34.62.47.252:443 (changelog-backend.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,188 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","",""
|
||||||
|
"SSLv3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","",""
|
||||||
|
"TLS1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","",""
|
||||||
|
"TLS1_1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","",""
|
||||||
|
"TLS1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||||
|
"TLS1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered with final","",""
|
||||||
|
"NPN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","",""
|
||||||
|
"ALPN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","",""
|
||||||
|
"cipher-tls1_2_xc02f","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc027","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc028","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc061","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc060","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc014","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc013","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc09d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||||
|
"cipher-tls1_2_xc051","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x9c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc09c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||||
|
"cipher-tls1_2_xc050","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3c","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x35","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x2f","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","false","",""
|
||||||
|
"cipher_order-tls1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","",""
|
||||||
|
"cipher-tls1_3_x1302","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipherorder_TLSv1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"prioritize_chacha_TLSv1_3","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","false","",""
|
||||||
|
"cipher_order","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","server","",""
|
||||||
|
"FS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","offered","",""
|
||||||
|
"FS_ciphers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","X25519MLKEM768","",""
|
||||||
|
"FS_ECDHE_curves","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||||
|
"DH_groups","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ffdhe2048 ffdhe3072","",""
|
||||||
|
"FS_TLS12_sig_algs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||||
|
"FS_TLS13_sig_algs","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||||
|
"TLS_extensions","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","valid for 7200 seconds only (<daily)","",""
|
||||||
|
"SSL_sessionID_support","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","supported","",""
|
||||||
|
"sessionresumption_ID","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","random","",""
|
||||||
|
"certificate_compression","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","none","",""
|
||||||
|
"clientAuth","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","none","",""
|
||||||
|
"cert_numbers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||||
|
"cert_serialNumber","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||||
|
"cert_serialNumberLen","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||||
|
"cert_fingerprintSHA256","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||||
|
"cert","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","*.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*.shelly.cloud shelly.cloud","",""
|
||||||
|
"cert_trust","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","no","",""
|
||||||
|
"cert_expirationStatus","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","63 >= 60 days","",""
|
||||||
|
"cert_notBefore","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2025-12-07 00:00","",""
|
||||||
|
"cert_notAfter","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2027-01-06 23:59","",""
|
||||||
|
"cert_extlifeSpan","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","",""
|
||||||
|
"cert_ocspURL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","http://ocsp.sectigo.com","",""
|
||||||
|
"OCSP_stapling","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","not offered","",""
|
||||||
|
"cert_mustStapleExtension","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","",""
|
||||||
|
"DNS_CAArecord","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","--","",""
|
||||||
|
"certificate_transparency","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","no","",""
|
||||||
|
"cert_caIssuers","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||||
|
"intermediate_cert <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2036-03-21 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||||
|
"intermediate_cert <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","2010-02-01 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert_badOCSP","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","404 Not Found ('/')","",""
|
||||||
|
"HTTP_clock_skew","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","1793779578","",""
|
||||||
|
"HSTS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","not offered","",""
|
||||||
|
"HPKP","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No Server banner line in header, interesting!","",""
|
||||||
|
"banner_application","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No application banner found","",""
|
||||||
|
"cookie_count","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","0 at '/' (maybe missed the application)","",""
|
||||||
|
"Access-Control-Allow-Origin","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","*","",""
|
||||||
|
"banner_reverseproxy","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","shelly-101-eu.shelly.cloud/34.79.5.199","31234","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_X","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_11_12","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_13_14","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_15","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-chrome_101_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-chromium_137_win11","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-firefox_100_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-firefox_137_win11","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-ie_8_win7","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_7u25","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1102","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1703","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_2106","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-go_1178","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-libressl_336","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_102e","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"rating_spec","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","30","",""
|
||||||
|
"key_exchange_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","27","",""
|
||||||
|
"cipher_strength_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","36","",""
|
||||||
|
"final_score","shelly-101-eu.shelly.cloud/34.79.5.199","31234","INFO","93","",""
|
||||||
|
"overall_grade","shelly-101-eu.shelly.cloud/34.79.5.199","31234","OK","A+","",""
|
||||||
|
@@ -0,0 +1,242 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 09:05:46 -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (34.79.5.199): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (server order)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||||
|
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span> -- mitigated (disconnect after 4/10 attempts)
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 09:06:59 [ 75s] -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,841 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_101eu shelly-101-eu.shelly.cloud:31234",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793779544",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "shelly-101-eu.shelly.cloud",
|
||||||
|
"ip" : "34.79.5.199",
|
||||||
|
"port" : "31234",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc027",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc028",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc061",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc060",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc051",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc050",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3d",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3c",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "X25519MLKEM768"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||||
|
},{
|
||||||
|
"id" : "DH_groups",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ffdhe2048 ffdhe3072"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "valid for 7200 seconds only (<daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "63 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-12-07 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-06 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ocsp.sectigo.com"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2036-03-21 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2010-02-01 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "404 Not Found ('/')"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793779578"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No Server banner line in header, interesting!"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "Access-Control-Allow-Origin",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, mitigated"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 75
|
||||||
|
}
|
||||||
@@ -0,0 +1,221 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_101eu shelly-101-eu.shelly.cloud:31234"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 09:05:46 -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (34.79.5.199): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (server order)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||||
|
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets: yes, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [m--
|
||||||
|
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||||
|
[1m OCSP stapling [m[1;33mnot offered[m
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||||
|
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||||
|
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m -- mitigated (disconnect after 4/10 attempts)
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 09:06:59 [ 75s] -->> 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,174 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","",""
|
||||||
|
"SSLv3","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","",""
|
||||||
|
"TLS1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||||
|
"TLS1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered with final","",""
|
||||||
|
"NPN","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||||
|
"ALPN","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not offered","",""
|
||||||
|
"cipherlist_STRONG_FS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_2_xc030","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x9f","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xccaa","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc02f","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x9e","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"cipher_order-tls1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_3_x1302","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher_order","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","NOT a server cipher order configured","",""
|
||||||
|
"FS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||||
|
"FS_ciphers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","prime256v1 secp384r1 X25519","",""
|
||||||
|
"DH_groups","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ffdhe2048","",""
|
||||||
|
"FS_TLS12_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224","",""
|
||||||
|
"FS_TLS13_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||||
|
"TLS_extensions","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no -- no lifetime advertised","",""
|
||||||
|
"SSL_sessionID_support","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not supported","",""
|
||||||
|
"sessionresumption_ID","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","supported","",""
|
||||||
|
"TLS_timestamp","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","random","",""
|
||||||
|
"certificate_compression","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","none","",""
|
||||||
|
"clientAuth","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","none","",""
|
||||||
|
"cert_numbers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||||
|
"cert_serialNumber","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||||
|
"cert_serialNumberLen","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||||
|
"cert_fingerprintSHA256","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||||
|
"cert","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","*.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||||
|
"cert_trust","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","63 >= 60 days","",""
|
||||||
|
"cert_notBefore","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2025-12-07 00:00","",""
|
||||||
|
"cert_notAfter","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2027-01-06 23:59","",""
|
||||||
|
"cert_extlifeSpan","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","",""
|
||||||
|
"cert_ocspURL","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","http://ocsp.sectigo.com","",""
|
||||||
|
"OCSP_stapling","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","offered","",""
|
||||||
|
"cert_ocspRevoked","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not revoked","",""
|
||||||
|
"cert_mustStapleExtension","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","--","",""
|
||||||
|
"certificate_transparency","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||||
|
"intermediate_cert <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2036-03-21 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||||
|
"intermediate_cert <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","2010-02-01 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert_badOCSP","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","401 Unauthorized ('/') --","",""
|
||||||
|
"HTTP_clock_skew","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","1793778429","",""
|
||||||
|
"HSTS","shelly-120-eu.shelly.cloud/104.155.32.247","443","LOW","not offered","",""
|
||||||
|
"HPKP","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||||
|
"banner_application","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No application banner found","",""
|
||||||
|
"cookie_count","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||||
|
"Access-Control-Allow-Origin","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","*","",""
|
||||||
|
"banner_reverseproxy","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM-common_primes","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","RFC7919/ffdhe2048","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_X","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_15","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_win81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_15_win10","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_7u25","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1102","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1703","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_2106","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-go_1178","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"clientsimulation-openssl_102e","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_111d","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"rating_spec","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","30","",""
|
||||||
|
"key_exchange_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","27","",""
|
||||||
|
"cipher_strength_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","36","",""
|
||||||
|
"final_score","shelly-120-eu.shelly.cloud/104.155.32.247","443","INFO","93","",""
|
||||||
|
"overall_grade","shelly-120-eu.shelly.cloud/104.155.32.247","443","OK","A+","",""
|
||||||
|
+229
@@ -0,0 +1,229 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 08:46:41 -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (104.155.32.247): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x9f DHE-RSA-AES256-GCM-SHA384 DH<span style="color:#008817;"> 2048</span> AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xccaa DHE-RSA-CHACHA20-POLY1305 DH<span style="color:#008817;"> 2048</span> ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9e DHE-RSA-AES128-GCM-SHA256 DH<span style="color:#008817;"> 2048</span> AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||||
|
(limited sense as client will pick)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||||
|
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||||
|
DHE-RSA-AES128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">X25519</span>
|
||||||
|
<span style="font-weight:bold;"> DH group offered: </span><span style="color:#008817;">ffdhe2048</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "status request/#5"
|
||||||
|
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "supported versions/#43"
|
||||||
|
"key share/#51" "renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#008817;">offered</span>, <span style="color:#008817;">not revoked</span>
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 401 Unauthorized
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental common prime with 2048 bits detected: <i>RFC7919/ffdhe2048</i> (<span style="color:#008817;">2048 bits</span>),
|
||||||
|
but no DH EXPORT ciphers
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||||
|
IE 11 Win Phone 8.1 No connection
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 08:47:32 [ 53s] -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
+785
@@ -0,0 +1,785 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_120eu shelly-120-eu.shelly.cloud:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793778399",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "shelly-120-eu.shelly.cloud",
|
||||||
|
"ip" : "104.155.32.247",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xccaa",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9e",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a server cipher order configured"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 X25519"
|
||||||
|
},{
|
||||||
|
"id" : "DH_groups",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ffdhe2048"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no -- no lifetime advertised"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "63 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-12-07 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-06 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ocsp.sectigo.com"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspRevoked",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not revoked"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2036-03-21 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2010-02-01 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "401 Unauthorized ('/') --"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793778429"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "Access-Control-Allow-Origin",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "no session ticket extension"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "RFC7919/ffdhe2048"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 53
|
||||||
|
}
|
||||||
@@ -0,0 +1,208 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_120eu shelly-120-eu.shelly.cloud:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 08:46:41 -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (104.155.32.247): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x9f DHE-RSA-AES256-GCM-SHA384 DH[0;32m 2048[m AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xccaa DHE-RSA-CHACHA20-POLY1305 DH[0;32m 2048[m ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9e DHE-RSA-AES128-GCM-SHA256 DH[0;32m 2048[m AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [mno
|
||||||
|
(limited sense as client will pick)
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||||
|
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||||
|
DHE-RSA-AES128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32mX25519[m
|
||||||
|
[1m DH group offered: [m[0;32mffdhe2048[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "status request/#5"
|
||||||
|
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "supported versions/#43"
|
||||||
|
"key share/#51" "renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets no, ID: yes
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [m--
|
||||||
|
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||||
|
[1m OCSP stapling [m[0;32moffered[m, [0;32mnot revoked[m
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||||
|
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 401 Unauthorized
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||||
|
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||||
|
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental common prime with 2048 bits detected: [3mRFC7919/ffdhe2048[m ([0;32m2048 bits[m),
|
||||||
|
but no DH EXPORT ciphers
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||||
|
IE 11 Win Phone 8.1 No connection
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 08:47:32 [ 53s] -->> 104.155.32.247:443 (shelly-120-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
+177
@@ -0,0 +1,177 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","shelly-120-eu.shelly.cloud/104.155.32.247","6113","DEBUG","Couldn't determine service, skipping all HTTP checks","",""
|
||||||
|
"pre_128cipher","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","",""
|
||||||
|
"SSLv3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","",""
|
||||||
|
"TLS1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","",""
|
||||||
|
"TLS1_1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","",""
|
||||||
|
"TLS1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||||
|
"TLS1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered with final","",""
|
||||||
|
"NPN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","",""
|
||||||
|
"ALPN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","",""
|
||||||
|
"cipher-tls1_2_xc02f","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc027","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc028","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc061","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc060","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc014","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc013","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc09d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||||
|
"cipher-tls1_2_xc051","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x9c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc09c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||||
|
"cipher-tls1_2_xc050","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3c","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x35","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x2f","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","false","",""
|
||||||
|
"cipher_order-tls1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","",""
|
||||||
|
"cipher-tls1_3_x1302","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipherorder_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"prioritize_chacha_TLSv1_3","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","false","",""
|
||||||
|
"cipher_order","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","server","",""
|
||||||
|
"FS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","offered","",""
|
||||||
|
"FS_ciphers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","X25519MLKEM768","",""
|
||||||
|
"FS_ECDHE_curves","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||||
|
"DH_groups","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ffdhe2048 ffdhe3072","",""
|
||||||
|
"FS_TLS12_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||||
|
"FS_TLS13_sig_algs","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||||
|
"TLS_extensions","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","valid for 7200 seconds only (<daily)","",""
|
||||||
|
"SSL_sessionID_support","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","supported","",""
|
||||||
|
"sessionresumption_ID","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","random","",""
|
||||||
|
"certificate_compression","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","none","",""
|
||||||
|
"clientAuth","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","none","",""
|
||||||
|
"cert_numbers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||||
|
"cert_serialNumber","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||||
|
"cert_serialNumberLen","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||||
|
"cert_fingerprintSHA256","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||||
|
"cert","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","*.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","*.shelly.cloud shelly.cloud","",""
|
||||||
|
"cert_trust","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","no","",""
|
||||||
|
"cert_expirationStatus","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","63 >= 60 days","",""
|
||||||
|
"cert_notBefore","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2025-12-07 00:00","",""
|
||||||
|
"cert_notAfter","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2027-01-06 23:59","",""
|
||||||
|
"cert_extlifeSpan","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","--","",""
|
||||||
|
"cert_ocspURL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","http://ocsp.sectigo.com","",""
|
||||||
|
"OCSP_stapling","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","not offered","",""
|
||||||
|
"cert_mustStapleExtension","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","--","",""
|
||||||
|
"DNS_CAArecord","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","--","",""
|
||||||
|
"certificate_transparency","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","no","",""
|
||||||
|
"cert_caIssuers","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||||
|
"intermediate_cert <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2036-03-21 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||||
|
"intermediate_cert <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","2010-02-01 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert_badOCSP","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"heartbleed","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","not applicable, not HTTP","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","shelly-120-eu.shelly.cloud/104.155.32.247","6113","MEDIUM","VULNERABLE, potential DoS threat","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable (not using HTTP anyway)","CVE-2012-4929","CWE-310"
|
||||||
|
"POODLE_SSL","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","shelly-120-eu.shelly.cloud/104.155.32.247","6113","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_X","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_11_12","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_13_14","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_15","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-chrome_101_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-chromium_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-firefox_100_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-firefox_137_win11","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-ie_8_win7","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_7u25","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1102","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1703","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_2106","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-go_1178","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-libressl_336","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_102e","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"rating_spec","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","30","",""
|
||||||
|
"key_exchange_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","27","",""
|
||||||
|
"cipher_strength_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","36","",""
|
||||||
|
"final_score","shelly-120-eu.shelly.cloud/104.155.32.247","6113","INFO","93","",""
|
||||||
|
"overall_grade","shelly-120-eu.shelly.cloud/104.155.32.247","6113","OK","A+","",""
|
||||||
|
+229
@@ -0,0 +1,229 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 08:54:02 -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (104.155.32.247): --
|
||||||
|
Service detected: Couldn't determine what's running on port 6113, assuming no HTTP service => skipping all HTTP checks
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (server order)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||||
|
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#c05600;">VULNERABLE (NOT ok)</span>, potential DoS threat
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span> (not using HTTP anyway)
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
Could not determine the protocol, only simulating generic clients.
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 08:55:14 [ 73s] -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
+794
@@ -0,0 +1,794 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_120eu_6133 shelly-120-eu.shelly.cloud:6113",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793778841",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "shelly-120-eu.shelly.cloud",
|
||||||
|
"ip" : "104.155.32.247",
|
||||||
|
"port" : "6113",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "Couldn't determine service, skipping all HTTP checks",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc027",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc028",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc061",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc060",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc051",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc050",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3d",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3c",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "X25519MLKEM768"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||||
|
},{
|
||||||
|
"id" : "DH_groups",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ffdhe2048 ffdhe3072"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "valid for 7200 seconds only (<daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "63 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-12-07 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-06 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ocsp.sectigo.com"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2036-03-21 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2010-02-01 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not applicable, not HTTP"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "MEDIUM",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "VULNERABLE, potential DoS threat"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable (not using HTTP anyway)"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 73
|
||||||
|
}
|
||||||
+208
@@ -0,0 +1,208 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_120eu_6133 shelly-120-eu.shelly.cloud:6113"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 08:54:02 -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (104.155.32.247): --
|
||||||
|
Service detected: Couldn't determine what's running on port 6113, assuming no HTTP service => skipping all HTTP checks
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (server order)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||||
|
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets: yes, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [m--
|
||||||
|
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||||
|
[1m OCSP stapling [m[1;33mnot offered[m
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||||
|
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. (applicable only for HTTP service)
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;33mVULNERABLE (NOT ok)[m, potential DoS threat
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m (not using HTTP anyway)
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
Could not determine the protocol, only simulating generic clients.
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 08:55:14 [ 73s] -->> 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,166 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","control.shelly.cloud/34.95.90.149","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","control.shelly.cloud/34.95.90.149","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","control.shelly.cloud/34.95.90.149","443","OK","not offered","",""
|
||||||
|
"SSLv3","control.shelly.cloud/34.95.90.149","443","OK","not offered","",""
|
||||||
|
"TLS1","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","control.shelly.cloud/34.95.90.149","443","OK","offered","",""
|
||||||
|
"TLS1_3","control.shelly.cloud/34.95.90.149","443","OK","offered with final","",""
|
||||||
|
"NPN","control.shelly.cloud/34.95.90.149","443","INFO","offered with grpc-exp, h2, http/1.1, http/1.0 (advertised)","",""
|
||||||
|
"ALPN_HTTP2","control.shelly.cloud/34.95.90.149","443","OK","h2","",""
|
||||||
|
"ALPN","control.shelly.cloud/34.95.90.149","443","INFO","http/1.1grpc-exp","",""
|
||||||
|
"cipherlist_NULL","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","control.shelly.cloud/34.95.90.149","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","control.shelly.cloud/34.95.90.149","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","control.shelly.cloud/34.95.90.149","443","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||||
|
"cipherlist_STRONG_FS","control.shelly.cloud/34.95.90.149","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","control.shelly.cloud/34.95.90.149","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
|
||||||
|
"cipher-tls1_2_xc02f","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xcca8","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc013","control.shelly.cloud/34.95.90.149","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc014","control.shelly.cloud/34.95.90.149","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","control.shelly.cloud/34.95.90.149","443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","control.shelly.cloud/34.95.90.149","443","INFO","true","",""
|
||||||
|
"cipher_order-tls1_3","control.shelly.cloud/34.95.90.149","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_3_x1302","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","control.shelly.cloud/34.95.90.149","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_3","control.shelly.cloud/34.95.90.149","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher_order","control.shelly.cloud/34.95.90.149","443","OK","server -- TLS 1.3 client determined","",""
|
||||||
|
"FS","control.shelly.cloud/34.95.90.149","443","OK","offered","",""
|
||||||
|
"FS_ciphers","control.shelly.cloud/34.95.90.149","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"FS_KEMs","control.shelly.cloud/34.95.90.149","443","OK","X25519MLKEM768","",""
|
||||||
|
"FS_ECDHE_curves","control.shelly.cloud/34.95.90.149","443","OK","prime256v1 secp384r1 X25519","",""
|
||||||
|
"FS_TLS12_sig_algs","control.shelly.cloud/34.95.90.149","443","LOW","RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1","",""
|
||||||
|
"FS_TLS13_sig_algs","control.shelly.cloud/34.95.90.149","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||||
|
"TLS_extensions","control.shelly.cloud/34.95.90.149","443","INFO","'server name/#0' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'next protocol/#13172' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","control.shelly.cloud/34.95.90.149","443","LOW","valid for 100800 seconds (>daily)","",""
|
||||||
|
"SSL_sessionID_support","control.shelly.cloud/34.95.90.149","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","control.shelly.cloud/34.95.90.149","443","INFO","supported","",""
|
||||||
|
"sessionresumption_ID","control.shelly.cloud/34.95.90.149","443","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","control.shelly.cloud/34.95.90.149","443","INFO","random","",""
|
||||||
|
"certificate_compression","control.shelly.cloud/34.95.90.149","443","INFO","none","",""
|
||||||
|
"clientAuth","control.shelly.cloud/34.95.90.149","443","INFO","none","",""
|
||||||
|
"cert_numbers","control.shelly.cloud/34.95.90.149","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","control.shelly.cloud/34.95.90.149","443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","control.shelly.cloud/34.95.90.149","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","control.shelly.cloud/34.95.90.149","443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","control.shelly.cloud/34.95.90.149","443","INFO","TLS Web Server Authentication","",""
|
||||||
|
"cert_serialNumber","control.shelly.cloud/34.95.90.149","443","INFO","FBD73E92DBE13DC80A3FB4DD63E368DB","",""
|
||||||
|
"cert_serialNumberLen","control.shelly.cloud/34.95.90.149","443","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","control.shelly.cloud/34.95.90.149","443","INFO","37515BC1C73B336535ED37F1CD9278384F9E0E98","",""
|
||||||
|
"cert_fingerprintSHA256","control.shelly.cloud/34.95.90.149","443","INFO","6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3","",""
|
||||||
|
"cert","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFFDCCA/ygAwIBAgIRAPvXPpLb4T3ICj+03WPjaNswDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoGA1UEAxMDV1IzMB4XDTI2MTAxODIzNDQ1NVoXDTI3MDExNzAwMzkyOVowHzEdMBsGA1UEAxMUY29udHJvbC5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbUihR957TsP8TL3V6Rqlf3ncgnYgSEFXgWjPhzlCCkOW3dyhfvXT+cJsF+8/CDVji0Os5PKmWijlL0mcv6iXzw4Oqls1yayq6mVLBpXLoqCvR5WtSGoceEFhELIPSBvhvGlXsab5gCkG+wIBkfelZT5A3oSpRUAVENz4sZN+Y1/4+iS2E+CDxRtVvuZrWKM90ZlCqjFeGvWb6FpMUfjse+1OHBxK53KIosggb/QECKuZFW+8pdo76aYkZyn6dKvlKK2LAL0O3bbRbj1TY79KYQ8CiUS5GGlaXsyFKnYht+el6jvLESoARAZLskdh+/6lPrBMjhlwN//D+iDEQ4HNhAgMBAAGjggItMIICKTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4VYfOqiY+fz7YO1R/DF8usWFNNowHwYDVR0jBBgwFoAUx4H1/Y6I2QA8TWOiUDEkoM4j/iMwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjMuY3J0MB8GA1UdEQQYMBaCFGNvbnRyb2wuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dyMy9IZUxMSkNnTHhoRS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaFRnmDgAAAEAwBHMEUCIEz7/8a+28tg2XIrDGjAS44EUvcbPZRSl6m1SVexCJG3AiEAkGPO4c9doniOhqoRz6e12hzO3QfDa8TAkpRdoBJ4DooAfwCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAaFRnmIUAAgAAAUAJ8ClvwQDAEgwRgIhAKSCz56h72qUgBghlI5rkkWcKAMfikzxU1Effie8NKK1AiEAt7xx/ZGBjLkPeM2ZkBEhaAJVRE1/w8h9x2JSsXfeMxIwDQYJKoZIhvcNAQELBQADggEBACpCa22KEenOoelJMLIhBihS5B++QtjVmhIO/dSKv1Qmj+LiIIUcvnS0MKgM8sxfpOwTkoinCtGrAnZn6pMpTbG6OMaa3EIOY1kxYhFhQ9XeVMpwwW/l/DU+jcGDr33pMixBFCscyO4rt4ljQmT/59MR3TVA8mPSqLJy0wHhEKXbthmliuiiR0CGABYMsi9u7Cc0MpmIZ94/GeHM0uMGmMf4A87Qa4k7niL5xOn09poZ5YGh9tZcffqUvO1IAVrdo6ZhRCCNl5z+nP1aDqXUtlk51tnt6Mn7OqXSAN8Mby8G7asj4jG1HVXMyQGfa5aGYtAyezLgBsXxdLnj4lq8xgY=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","control.shelly.cloud/34.95.90.149","443","OK","control.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","control.shelly.cloud/34.95.90.149","443","INFO","control.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","control.shelly.cloud/34.95.90.149","443","INFO","control.shelly.cloud","",""
|
||||||
|
"cert_trust","control.shelly.cloud/34.95.90.149","443","OK","Ok via SAN and CN (same w/o SNI)","",""
|
||||||
|
"cert_chain_of_trust","control.shelly.cloud/34.95.90.149","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","control.shelly.cloud/34.95.90.149","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","control.shelly.cloud/34.95.90.149","443","OK","73 >= 60 days","",""
|
||||||
|
"cert_notBefore","control.shelly.cloud/34.95.90.149","443","INFO","2026-10-18 23:44","",""
|
||||||
|
"cert_notAfter","control.shelly.cloud/34.95.90.149","443","OK","2027-01-17 00:39","",""
|
||||||
|
"cert_extlifeSpan","control.shelly.cloud/34.95.90.149","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","control.shelly.cloud/34.95.90.149","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","control.shelly.cloud/34.95.90.149","443","INFO","http://c.pki.goog/wr3/HeLLJCgLxhE.crl","",""
|
||||||
|
"cert_ocspURL","control.shelly.cloud/34.95.90.149","443","INFO","--","",""
|
||||||
|
"OCSP_stapling","control.shelly.cloud/34.95.90.149","443","INFO","not offered","",""
|
||||||
|
"cert_mustStapleExtension","control.shelly.cloud/34.95.90.149","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","control.shelly.cloud/34.95.90.149","443","LOW","--","",""
|
||||||
|
"certificate_transparency","control.shelly.cloud/34.95.90.149","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","control.shelly.cloud/34.95.90.149","443","INFO","3","",""
|
||||||
|
"certs_list_ordering_problem","control.shelly.cloud/34.95.90.149","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","control.shelly.cloud/34.95.90.149","443","INFO","WR3 (Google Trust Services from US)","",""
|
||||||
|
"intermediate_cert <#1>","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFCzCCAvOgAwIBAgIQf/AFqRVo1jq8IoYWhKpLWjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPNHWHr4RyFI0HEJFvA6zx1Ag1mhnymxiJNGyYj3rU3eoF6N4bfIxUErp5ivsYDQ18nPO9OOSoXsYzy0aJb0ag6TdjjdzM1ZdOMq17HSMFufV7SUOY0LxXx1N4GLHtp1SyfIa+8FRFvIe6mVkd9LjbAPuBT0YrYl6xOqUqFyOsor7FjuVe/XEefaS0I30EUrI00t+ZrIfGTFlf+OZPjnWSwrIwRpLQtg3H5Iln/z9UlCdl4wHISiyEL2Vfza1c/aatQVvcTD8XlpF9qdg8Uyoc0ObUd+ZDSsK3+Eiiza1jtSVrlnIdgUVvhmnE5OZ4TDHmoX+nAXMKh++HiXLM08WNAgMBAAGjgf4wgfswDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHgfX9jojZADxNY6JQMSSgziP+IzAfBgNVHSMEGDAWgBTkrysmcRorSCeFL1JmLO/wiRNxPjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAKGGGh0dHA6Ly9pLnBraS5nb29nL3IxLmNydDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vYy5wa2kuZ29vZy9yL3IxLmNybDATBgNVHSAEDDAKMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAgEAnI1DlJQzSKcWbyXXrJSsgKMo6KG74TMqhsuTg67a0FX02752+eiJb5YsOJc8DVOHalwpOvbuPdl5BuAEgIK4Va7l9j3J9M1/EjeWjGTM3RoszmBJGu82oz6EWi5q75xeF+onJmh2Hm98a/yJAI/mODXq5LofYcQ9AffKP9ZMZu+YwW+/qHqyX2JhaOntvl7i8S+l1Y8CcKEqM1NFK4s4EBYPRFjZDawOHX7fSchbSMVPn5Nu04lrU6xufuZqRosEQw2o0UAyzDoyA52NXzJTWr1G2FVg/0A9hdrQ/6fe9G3167zKxNqXErs6MpHttEouGbpm2ftzrmcvruYxTfxc4G2GwBi3LFLozNpy042gDfXBzDyn1staWsy7+QnzMlR59Fz6jBOk5R4LT+ma0+KjnfRhMh5T2ucm69HkvNQtDZlVa1tLUlzs0zLEdQSehTCjZ6SYsGt2bMVK6dvtxzcyCP0QDUFnNXCwgw12+mGSkAuj4ORi8kMRpnL8UEjkNbdw9KL1eYbEC3D0GPue2Yk2AGhxkmcdm1BoOp05kYw/Nnqgh7QV8DKyBTUHbjH0pXlLiOsSOY+CLh1eTM+Do6rSjqGnDQeUXylZmPCmuveaw38IVnBaa6Eiz6pngZ1u6OeO/1UzfhmyTm0n0G+9JZ3KS2Mq08isNgXHLnhlHJaphpE=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","control.shelly.cloud/34.95.90.149","443","INFO","2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","control.shelly.cloud/34.95.90.149","443","INFO","2023-12-13 09:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","control.shelly.cloud/34.95.90.149","443","OK","2029-02-20 14:00","",""
|
||||||
|
"intermediate_cert_expiration <#1>","control.shelly.cloud/34.95.90.149","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","control.shelly.cloud/34.95.90.149","443","INFO","WR3 <-- GTS Root R1","",""
|
||||||
|
"intermediate_cert <#2>","control.shelly.cloud/34.95.90.149","443","INFO","-----BEGIN CERTIFICATE-----\nMIIFYjCCBEqgAwIBAgIQd70NbNs2+RrqIQ/E8FjTDTANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UECxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIwMDYxOTAwMDA0MloXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFIxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAthECix7joXebO9y/lD63ladAPKH9gvl9MgaCcfb2jH/76Nu8ai6Xl6OMS/kr9rH5zoQdsfnFl97vufKj6bwSiV6nqlKr+CMny6SxnGPb15l+8Ape62im9MZaRw1NEDPjTrETo8gYbEvs/AmQ351kKSUjB6G00j0uYODP0gmHu81I8E3CwnqIiru6z1kZ1q+PsAewnjHxgsHA3y6mbWwZDrXYfiYaRQM9sHmklCitD38m5agI/pboPGiUU+6DOogrFZYJsuB6jC511pzrp1Zkj5ZPaK49l8KEj8C8QMALXL32h7M1bKwYUH+E4EzNktMg6TO8UpmvMrUpsyUqtEj5cuHKZPfmghCN6J3Cioj6OGaK/GP5Afl4/Xtcd/p2h/rs37EOeZVXtL0m79YB0esWCruOC7XFxYpVq9Os6pFLKcwZpDIlTirxZUTQAs6qzkm06p98g7BAe+dDq6dso499iYH6TKX/1Y7DzkvgtdizjkXPdsDtQCv9Uw+wp9U7DbGKogPeMa3Md+pvez7W35EiEua++tgy/BBjFFFy3l3WFpO9KWgz7zpm7AeKJt8T11dleCfeXkkUAKIAf5qoIbapsZWwpbkNFhHax2xIPEDgfg1azVY80ZcFuctL7TlLnMQ/0lUTbiSw1nH69MG6zO0b9f6BQdgAmD06yK56mDcYBZUCAwEAAaOCATgwggE0MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTkrysmcRorSCeFL1JmLO/wiRNxPjAfBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzBgBggrBgEFBQcBAQRUMFIwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnBraS5nb29nL2dzcjEwKQYIKwYBBQUHMAKGHWh0dHA6Ly9wa2kuZ29vZy9nc3IxL2dzcjEuY3J0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwucGtpLmdvb2cvZ3NyMS9nc3IxLmNybDA7BgNVHSAENDAyMAgGBmeBDAECATAIBgZngQwBAgIwDQYLKwYBBAHWeQIFAwIwDQYLKwYBBAHWeQIFAwMwDQYJKoZIhvcNAQELBQADggEBADSkHrEoo9C0dhemMXoh6dFSPsjbdBZBiLg9NR3t5P+T4Vxfq7vqfM/b5A3Ri1fyJm9bvhdGaJQ3b2t6yMAYN/olUazsaL+yyEn9WprKASOshIArAoyZl+tJaox118fessmXn1hIVw41oeQa1v1vg4Fv74zPl6/AhSrw9U5pCZEt4Wi4wStz6dTZ/CLANx8LZh1J7QJVj2fhMtfTJr9w4z30Z209fOU0iOMy+qduBmpvvYuR7hZL6Dupszfnw0Skfths18dG9ZKb59UhvmaSGZRVbNQpsg3BZlvid0lIKO2d1xozclOzgjXPYovJJIultzkMu34qQb9Sz/yilrbCgj8=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","control.shelly.cloud/34.95.90.149","443","INFO","3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","control.shelly.cloud/34.95.90.149","443","INFO","2020-06-19 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","control.shelly.cloud/34.95.90.149","443","OK","2028-01-28 00:00","",""
|
||||||
|
"intermediate_cert_expiration <#2>","control.shelly.cloud/34.95.90.149","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","control.shelly.cloud/34.95.90.149","443","INFO","GTS Root R1 <-- GlobalSign Root CA","",""
|
||||||
|
"intermediate_cert_badOCSP","control.shelly.cloud/34.95.90.149","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","control.shelly.cloud/34.95.90.149","443","INFO","200 OK ('/')","",""
|
||||||
|
"HTTP_clock_skew","control.shelly.cloud/34.95.90.149","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","control.shelly.cloud/34.95.90.149","443","INFO","1793778057","",""
|
||||||
|
"HSTS","control.shelly.cloud/34.95.90.149","443","LOW","not offered","",""
|
||||||
|
"HPKP","control.shelly.cloud/34.95.90.149","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","control.shelly.cloud/34.95.90.149","443","INFO","UploadServer","",""
|
||||||
|
"banner_application","control.shelly.cloud/34.95.90.149","443","INFO","No application banner found","",""
|
||||||
|
"cookie_count","control.shelly.cloud/34.95.90.149","443","INFO","0 at '/'","",""
|
||||||
|
"Cache-Control","control.shelly.cloud/34.95.90.149","443","INFO","no-transform, private, no-cache, no-store, must-revalidate, max-age=0","",""
|
||||||
|
"banner_reverseproxy","control.shelly.cloud/34.95.90.149","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","control.shelly.cloud/34.95.90.149","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","control.shelly.cloud/34.95.90.149","443","MEDIUM","potentially VULNERABLE, gzip deflate compress br HTTP compression detected - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","control.shelly.cloud/34.95.90.149","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","control.shelly.cloud/34.95.90.149","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","control.shelly.cloud/34.95.90.149","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","control.shelly.cloud/34.95.90.149","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","control.shelly.cloud/34.95.90.149","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_X","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_15","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","control.shelly.cloud/34.95.90.149","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA","",""
|
||||||
|
"clientsimulation-ie_11_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_7u25","control.shelly.cloud/34.95.90.149","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1102","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-java_1703","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_2106","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-go_1178","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"clientsimulation-openssl_102e","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","control.shelly.cloud/34.95.90.149","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"rating_spec","control.shelly.cloud/34.95.90.149","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","control.shelly.cloud/34.95.90.149","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","control.shelly.cloud/34.95.90.149","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","30","",""
|
||||||
|
"key_exchange_score","control.shelly.cloud/34.95.90.149","443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","27","",""
|
||||||
|
"cipher_strength_score","control.shelly.cloud/34.95.90.149","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","control.shelly.cloud/34.95.90.149","443","INFO","36","",""
|
||||||
|
"final_score","control.shelly.cloud/34.95.90.149","443","INFO","93","",""
|
||||||
|
"overall_grade","control.shelly.cloud/34.95.90.149","443","OK","A+","",""
|
||||||
|
@@ -0,0 +1,225 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 08:40:32 -->> 34.95.90.149:443 (control.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (34.95.90.149): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>grpc-exp, h2, http/1.1, http/1.0 (advertised)
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span><span style="color:#008817;">h2</span>, http/1.1, grpc-exp (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;">yes (OK)</span> -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">X25519</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384
|
||||||
|
RSA-PSS-RSAE+SHA512 RSA+SHA512 <span style="color:#a86437;">RSA+SHA1</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "next protocol/#13172"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>100800 seconds<span style="color:#a86437;"> but: FS requires session ticket keys to be rotated < daily !</span>
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>FBD73E92DBE13DC80A3FB4DD63E368DB (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 37515BC1C73B336535ED37F1CD9278384F9E0E98
|
||||||
|
SHA256 6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>control.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>control.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN and CN</span> (same w/o SNI)
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">73 >= 60 days</span> (2026-10-18 23:44 --> 2027-01-17 00:39)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>http://c.pki.goog/wr3/HeLLJCgLxhE.crl
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span>not offered
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 3
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>WR3</i> (<i>Google Trust Services</i> from <i>US</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2029-02-20 14:00). <i>WR3</i> <-- <i>GTS Root R1</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2028-01-28 00:00). <i>GTS Root R1</i> <-- <i>GlobalSign Root CA</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 200 OK
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>UploadServer'
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/")
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Cache-Control: no-transform, private, no-cache, no-store,
|
||||||
|
must-revalidate, max-age=0
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#c05600;">potentially NOT ok, "gzip deflate compress br" HTTP compression detected.</span> - only supplied "/" tested
|
||||||
|
Can be ignored for static pages or if no secrets in the page
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 08:41:24 [ 53s] -->> 34.95.90.149:443 (control.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,753 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_cloud_control control.shelly.cloud:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793778031",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "control.shelly.cloud",
|
||||||
|
"ip" : "34.95.90.149",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "offered with grpc-exp, h2, http/1.1, http/1.0 (advertised)"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN_HTTP2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "h2"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1grpc-exp"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- server prioritizes ChaCha ciphers when preferred by clients"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "true"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server -- TLS 1.3 client determined"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "X25519MLKEM768"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 X25519"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA512 RSA+SHA1"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'server name/#0' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'next protocol/#13172' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "valid for 100800 seconds (>daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "FBD73E92DBE13DC80A3FB4DD63E368DB"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "37515BC1C73B336535ED37F1CD9278384F9E0E98"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFFDCCA/ygAwIBAgIRAPvXPpLb4T3ICj+03WPjaNswDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczEMMAoGA1UEAxMDV1IzMB4XDTI2MTAxODIzNDQ1NVoXDTI3MDExNzAwMzkyOVowHzEdMBsGA1UEAxMUY29udHJvbC5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDbUihR957TsP8TL3V6Rqlf3ncgnYgSEFXgWjPhzlCCkOW3dyhfvXT+cJsF+8/CDVji0Os5PKmWijlL0mcv6iXzw4Oqls1yayq6mVLBpXLoqCvR5WtSGoceEFhELIPSBvhvGlXsab5gCkG+wIBkfelZT5A3oSpRUAVENz4sZN+Y1/4+iS2E+CDxRtVvuZrWKM90ZlCqjFeGvWb6FpMUfjse+1OHBxK53KIosggb/QECKuZFW+8pdo76aYkZyn6dKvlKK2LAL0O3bbRbj1TY79KYQ8CiUS5GGlaXsyFKnYht+el6jvLESoARAZLskdh+/6lPrBMjhlwN//D+iDEQ4HNhAgMBAAGjggItMIICKTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU4VYfOqiY+fz7YO1R/DF8usWFNNowHwYDVR0jBBgwFoAUx4H1/Y6I2QA8TWOiUDEkoM4j/iMwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29vZy93cjMuY3J0MB8GA1UdEQQYMBaCFGNvbnRyb2wuc2hlbGx5LmNsb3VkMBMGA1UdIAQMMAowCAYGZ4EMAQIBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jLnBraS5nb29nL3dyMy9IZUxMSkNnTHhoRS5jcmwwggENBgorBgEEAdZ5AgQCBIH+BIH7APkAdgBgTJqven93XwHUBvySDciZ6wscffjJUhv6+hd3O5eLyQAAAaFRnmDgAAAEAwBHMEUCIEz7/8a+28tg2XIrDGjAS44EUvcbPZRSl6m1SVexCJG3AiEAkGPO4c9doniOhqoRz6e12hzO3QfDa8TAkpRdoBJ4DooAfwCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAaFRnmIUAAgAAAUAJ8ClvwQDAEgwRgIhAKSCz56h72qUgBghlI5rkkWcKAMfikzxU1Effie8NKK1AiEAt7xx/ZGBjLkPeM2ZkBEhaAJVRE1/w8h9x2JSsXfeMxIwDQYJKoZIhvcNAQELBQADggEBACpCa22KEenOoelJMLIhBihS5B++QtjVmhIO/dSKv1Qmj+LiIIUcvnS0MKgM8sxfpOwTkoinCtGrAnZn6pMpTbG6OMaa3EIOY1kxYhFhQ9XeVMpwwW/l/DU+jcGDr33pMixBFCscyO4rt4ljQmT/59MR3TVA8mPSqLJy0wHhEKXbthmliuiiR0CGABYMsi9u7Cc0MpmIZ94/GeHM0uMGmMf4A87Qa4k7niL5xOn09poZ5YGh9tZcffqUvO1IAVrdo6ZhRCCNl5z+nP1aDqXUtlk51tnt6Mn7OqXSAN8Mby8G7asj4jG1HVXMyQGfa5aGYtAyezLgBsXxdLnj4lq8xgY=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "control.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "control.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "control.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN and CN (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "73 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2026-10-18 23:44"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-17 00:39"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://c.pki.goog/wr3/HeLLJCgLxhE.crl"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "3"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "WR3 (Google Trust Services from US)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFCzCCAvOgAwIBAgIQf/AFqRVo1jq8IoYWhKpLWjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPNHWHr4RyFI0HEJFvA6zx1Ag1mhnymxiJNGyYj3rU3eoF6N4bfIxUErp5ivsYDQ18nPO9OOSoXsYzy0aJb0ag6TdjjdzM1ZdOMq17HSMFufV7SUOY0LxXx1N4GLHtp1SyfIa+8FRFvIe6mVkd9LjbAPuBT0YrYl6xOqUqFyOsor7FjuVe/XEefaS0I30EUrI00t+ZrIfGTFlf+OZPjnWSwrIwRpLQtg3H5Iln/z9UlCdl4wHISiyEL2Vfza1c/aatQVvcTD8XlpF9qdg8Uyoc0ObUd+ZDSsK3+Eiiza1jtSVrlnIdgUVvhmnE5OZ4TDHmoX+nAXMKh++HiXLM08WNAgMBAAGjgf4wgfswDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHgfX9jojZADxNY6JQMSSgziP+IzAfBgNVHSMEGDAWgBTkrysmcRorSCeFL1JmLO/wiRNxPjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAKGGGh0dHA6Ly9pLnBraS5nb29nL3IxLmNydDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vYy5wa2kuZ29vZy9yL3IxLmNybDATBgNVHSAEDDAKMAgGBmeBDAECATANBgkqhkiG9w0BAQsFAAOCAgEAnI1DlJQzSKcWbyXXrJSsgKMo6KG74TMqhsuTg67a0FX02752+eiJb5YsOJc8DVOHalwpOvbuPdl5BuAEgIK4Va7l9j3J9M1/EjeWjGTM3RoszmBJGu82oz6EWi5q75xeF+onJmh2Hm98a/yJAI/mODXq5LofYcQ9AffKP9ZMZu+YwW+/qHqyX2JhaOntvl7i8S+l1Y8CcKEqM1NFK4s4EBYPRFjZDawOHX7fSchbSMVPn5Nu04lrU6xufuZqRosEQw2o0UAyzDoyA52NXzJTWr1G2FVg/0A9hdrQ/6fe9G3167zKxNqXErs6MpHttEouGbpm2ftzrmcvruYxTfxc4G2GwBi3LFLozNpy042gDfXBzDyn1staWsy7+QnzMlR59Fz6jBOk5R4LT+ma0+KjnfRhMh5T2ucm69HkvNQtDZlVa1tLUlzs0zLEdQSehTCjZ6SYsGt2bMVK6dvtxzcyCP0QDUFnNXCwgw12+mGSkAuj4ORi8kMRpnL8UEjkNbdw9KL1eYbEC3D0GPue2Yk2AGhxkmcdm1BoOp05kYw/Nnqgh7QV8DKyBTUHbjH0pXlLiOsSOY+CLh1eTM+Do6rSjqGnDQeUXylZmPCmuveaw38IVnBaa6Eiz6pngZ1u6OeO/1UzfhmyTm0n0G+9JZ3KS2Mq08isNgXHLnhlHJaphpE=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2FE357DB13751FF9160E87354975B3407498F41C9BD16A48657866E6E5A9B4C7"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2023-12-13 09:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2029-02-20 14:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "WR3 <-- GTS Root R1"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIFYjCCBEqgAwIBAgIQd70NbNs2+RrqIQ/E8FjTDTANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UECxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIwMDYxOTAwMDA0MloXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoTGUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFIxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAthECix7joXebO9y/lD63ladAPKH9gvl9MgaCcfb2jH/76Nu8ai6Xl6OMS/kr9rH5zoQdsfnFl97vufKj6bwSiV6nqlKr+CMny6SxnGPb15l+8Ape62im9MZaRw1NEDPjTrETo8gYbEvs/AmQ351kKSUjB6G00j0uYODP0gmHu81I8E3CwnqIiru6z1kZ1q+PsAewnjHxgsHA3y6mbWwZDrXYfiYaRQM9sHmklCitD38m5agI/pboPGiUU+6DOogrFZYJsuB6jC511pzrp1Zkj5ZPaK49l8KEj8C8QMALXL32h7M1bKwYUH+E4EzNktMg6TO8UpmvMrUpsyUqtEj5cuHKZPfmghCN6J3Cioj6OGaK/GP5Afl4/Xtcd/p2h/rs37EOeZVXtL0m79YB0esWCruOC7XFxYpVq9Os6pFLKcwZpDIlTirxZUTQAs6qzkm06p98g7BAe+dDq6dso499iYH6TKX/1Y7DzkvgtdizjkXPdsDtQCv9Uw+wp9U7DbGKogPeMa3Md+pvez7W35EiEua++tgy/BBjFFFy3l3WFpO9KWgz7zpm7AeKJt8T11dleCfeXkkUAKIAf5qoIbapsZWwpbkNFhHax2xIPEDgfg1azVY80ZcFuctL7TlLnMQ/0lUTbiSw1nH69MG6zO0b9f6BQdgAmD06yK56mDcYBZUCAwEAAaOCATgwggE0MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTkrysmcRorSCeFL1JmLO/wiRNxPjAfBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzBgBggrBgEFBQcBAQRUMFIwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnBraS5nb29nL2dzcjEwKQYIKwYBBQUHMAKGHWh0dHA6Ly9wa2kuZ29vZy9nc3IxL2dzcjEuY3J0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9jcmwucGtpLmdvb2cvZ3NyMS9nc3IxLmNybDA7BgNVHSAENDAyMAgGBmeBDAECATAIBgZngQwBAgIwDQYLKwYBBAHWeQIFAwIwDQYLKwYBBAHWeQIFAwMwDQYJKoZIhvcNAQELBQADggEBADSkHrEoo9C0dhemMXoh6dFSPsjbdBZBiLg9NR3t5P+T4Vxfq7vqfM/b5A3Ri1fyJm9bvhdGaJQ3b2t6yMAYN/olUazsaL+yyEn9WprKASOshIArAoyZl+tJaox118fessmXn1hIVw41oeQa1v1vg4Fv74zPl6/AhSrw9U5pCZEt4Wi4wStz6dTZ/CLANx8LZh1J7QJVj2fhMtfTJr9w4z30Z209fOU0iOMy+qduBmpvvYuR7hZL6Dupszfnw0Skfths18dG9ZKb59UhvmaSGZRVbNQpsg3BZlvid0lIKO2d1xozclOzgjXPYovJJIultzkMu34qQb9Sz/yilrbCgj8=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "3EE0278DF71FA3C125C4CD487F01D774694E6FC57E0CD94C24EFD769133918E5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2020-06-19 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2028-01-28 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "GTS Root R1 <-- GlobalSign Root CA"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "200 OK ('/')"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793778057"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "UploadServer"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/'"
|
||||||
|
},{
|
||||||
|
"id" : "Cache-Control",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no-transform, private, no-cache, no-store, must-revalidate, max-age=0"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "MEDIUM",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially VULNERABLE, gzip deflate compress br HTTP compression detected - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 53
|
||||||
|
}
|
||||||
@@ -0,0 +1,204 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_cloud_control control.shelly.cloud:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 08:40:32 -->> 34.95.90.149:443 (control.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (34.95.90.149): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mgrpc-exp, h2, http/1.1, http/1.0 (advertised)
|
||||||
|
[1m ALPN/HTTP2 [m[0;32mh2[m, http/1.1, grpc-exp (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order -- server prioritizes ChaCha ciphers when preferred by clients)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[0;32myes (OK)[m -- only for < TLS 1.3
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA
|
||||||
|
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32mX25519[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA+SHA256 RSA-PSS-RSAE+SHA384 RSA+SHA384
|
||||||
|
RSA-PSS-RSAE+SHA512 RSA+SHA512 [1;33mRSA+SHA1[m
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"server name/#0" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "next protocol/#13172"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m100800 seconds[1;33m but: FS requires session ticket keys to be rotated < daily ![m
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets: yes, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication
|
||||||
|
[1m Serial [mFBD73E92DBE13DC80A3FB4DD63E368DB (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 37515BC1C73B336535ED37F1CD9278384F9E0E98
|
||||||
|
SHA256 6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
|
||||||
|
[1m Common Name (CN) [m[3mcontrol.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3mcontrol.shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN and CN[m (same w/o SNI)
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m73 >= 60 days[m (2026-10-18 23:44 --> 2027-01-17 00:39)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [mhttp://c.pki.goog/wr3/HeLLJCgLxhE.crl
|
||||||
|
[1m OCSP URI [m--
|
||||||
|
[1m OCSP stapling [mnot offered
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 3
|
||||||
|
[1m Issuer [m[3mWR3[m ([3mGoogle Trust Services[m from [3mUS[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2029-02-20 14:00). [3mWR3[m <-- [3mGTS Root R1[m
|
||||||
|
#2: [0;32mok > 40 days[m (2028-01-28 00:00). [3mGTS Root R1[m <-- [3mGlobalSign Root CA[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 200 OK
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [mUploadServer
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m(none issued at "/")
|
||||||
|
[1m Security headers [mCache-Control: no-transform, private, no-cache, no-store,
|
||||||
|
must-revalidate, max-age=0
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;33mpotentially NOT ok, "gzip deflate compress br" HTTP compression detected.[m - only supplied "/" tested
|
||||||
|
Can be ignored for static pages or if no secrets in the page
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=6FB8A8976CBF88EE050A03427DF945FC26FA9C75B0ECBE8990DF0ED8EB765CB3
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32mX25519MLKEM768[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 08:41:24 [ 53s] -->> 34.95.90.149:443 (control.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,189 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","",""
|
||||||
|
"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","",""
|
||||||
|
"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||||
|
"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered + downgraded to weaker protocol","",""
|
||||||
|
"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","",""
|
||||||
|
"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","",""
|
||||||
|
"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc077","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc076","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc0a1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8","",""
|
||||||
|
"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||||
|
"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc0a0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8","",""
|
||||||
|
"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||||
|
"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xba","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x84","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x41","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","false","",""
|
||||||
|
"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","server","",""
|
||||||
|
"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","offered","",""
|
||||||
|
"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||||
|
"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||||
|
"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","valid for 300 seconds only (<daily)","",""
|
||||||
|
"SSL_sessionID_support","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","supported","",""
|
||||||
|
"sessionresumption_ID","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","random","",""
|
||||||
|
"cert_compression","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","N/A","",""
|
||||||
|
"clientAuth","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","none","",""
|
||||||
|
"cert_numbers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||||
|
"cert_serialNumber","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||||
|
"cert_serialNumberLen","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||||
|
"cert_fingerprintSHA256","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||||
|
"cert","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","*.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||||
|
"cert_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","63 >= 60 days","",""
|
||||||
|
"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2025-12-07 00:00","",""
|
||||||
|
"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2027-01-06 23:59","",""
|
||||||
|
"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","",""
|
||||||
|
"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","http://ocsp.sectigo.com","",""
|
||||||
|
"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","",""
|
||||||
|
"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","--","",""
|
||||||
|
"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||||
|
"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2036-03-21 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||||
|
"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","2010-02-01 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","WARN","Unexpected 500 Internal Server Error @ '/'","",""
|
||||||
|
"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","1793779728","",""
|
||||||
|
"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","not offered","",""
|
||||||
|
"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||||
|
"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No application banner found","",""
|
||||||
|
"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||||
|
"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","*","",""
|
||||||
|
"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","30","",""
|
||||||
|
"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","27","",""
|
||||||
|
"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","36","",""
|
||||||
|
"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","93","",""
|
||||||
|
"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","OK","A-","",""
|
||||||
|
"grade_cap_warning_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","443","INFO","TLS 1.3 is not supported","",""
|
||||||
|
@@ -0,0 +1,246 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (35.205.173.252): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span>not offered and downgraded to a weaker protocol
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order)
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH<span style="color:#008817;"> 253</span> Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH<span style="color:#008817;"> 253</span> Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||||
|
<u>TLSv1.3</u>
|
||||||
|
-
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
|
||||||
|
ECDHE-ARIA128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>300 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 500 Internal Server Error<span style="color:#cd00cd;">. Oh, didn't expect "500 Internal Server Error"</span>
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 500 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span> - ARIA, CHACHA or CCM ciphers found
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A-</span>
|
||||||
|
<span style="font-weight:bold;"> Grade warning </span><span style="color:#c05600;">TLS 1.3 is not supported</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,845 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793779704",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "shelly-infra1-eu.shelly.cloud",
|
||||||
|
"ip" : "35.205.173.252",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered + downgraded to weaker protocol"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc061",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc060",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc028",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc077",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc027",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc076",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc0a1",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc051",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc0a0",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc050",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3d",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc0",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3c",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xba",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x84",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x41",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM8 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM8 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 CAMELLIA256-SHA256 AES128-SHA256 CAMELLIA128-SHA256 AES256-SHA CAMELLIA256-SHA AES128-SHA CAMELLIA128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256 ECDHE-ARIA128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'server name/#0' 'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "valid for 300 seconds only (<daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "cert_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "N/A"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "63 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-12-07 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-06 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ocsp.sectigo.com"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2036-03-21 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2010-02-01 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "WARN",
|
||||||
|
"finding" : "Unexpected 500 Internal Server Error @ '/'"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793779728"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "Access-Control-Allow-Origin",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A-"
|
||||||
|
},{
|
||||||
|
"id" : "grade_cap_warning_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS 1.3 is not supported"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 64
|
||||||
|
}
|
||||||
@@ -0,0 +1,225 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_infra_443 shelly-infra1-eu.shelly.cloud:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 09:08:25 -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (35.205.173.252): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [mnot offered and downgraded to a weaker protocol
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order)
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH[0;32m 253[m Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH[0;32m 253[m Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||||
|
[4mTLSv1.3[m
|
||||||
|
-
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[1;32myes (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-RSA-CAMELLIA256-SHA384 ECDHE-ARIA256-GCM-SHA384
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
|
||||||
|
ECDHE-ARIA128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m300 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets: yes, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [m--
|
||||||
|
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||||
|
[1m OCSP stapling [m[1;33mnot offered[m
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||||
|
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 500 Internal Server Error[0;35m. Oh, didn't expect "500 Internal Server Error"[m
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m(none issued at "/") -- HTTP status 500 signals you maybe missed the web application
|
||||||
|
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m - ARIA, CHACHA or CCM ciphers found
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES256-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA-[m
|
||||||
|
[1m Grade warning [m[0;33mTLS 1.3 is not supported[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 09:09:28 [ 64s] -->> 35.205.173.252:443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,188 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","",""
|
||||||
|
"SSLv3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","",""
|
||||||
|
"TLS1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||||
|
"TLS1_1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||||
|
"TLS1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||||
|
"TLS1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered with final","",""
|
||||||
|
"NPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","",""
|
||||||
|
"ALPN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||||
|
"cipherlist_STRONG_FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||||
|
"cipher-tls1_2_xc02f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc030","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc027","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc028","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc061","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc060","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc014","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_xc013","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x9d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xc09d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM","",""
|
||||||
|
"cipher-tls1_2_xc051","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x9c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc09c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM","",""
|
||||||
|
"cipher-tls1_2_xc050","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x3c","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||||
|
"cipher-tls1_2_x35","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||||
|
"cipher-tls1_2_x2f","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA","",""
|
||||||
|
"cipherorder_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
|
||||||
|
"prioritize_chacha_TLSv1_2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","",""
|
||||||
|
"cipher_order-tls1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||||
|
"cipher-tls1_3_x1302","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipherorder_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"prioritize_chacha_TLSv1_3","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","false","",""
|
||||||
|
"cipher_order","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","server","",""
|
||||||
|
"FS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","offered","",""
|
||||||
|
"FS_ciphers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","X25519MLKEM768","",""
|
||||||
|
"FS_ECDHE_curves","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||||
|
"DH_groups","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ffdhe2048 ffdhe3072","",""
|
||||||
|
"FS_TLS12_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224","",""
|
||||||
|
"FS_TLS13_sig_algs","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||||
|
"TLS_extensions","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","valid for 7200 seconds only (<daily)","",""
|
||||||
|
"SSL_sessionID_support","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","supported","",""
|
||||||
|
"sessionresumption_ID","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not supported","",""
|
||||||
|
"TLS_timestamp","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","random","",""
|
||||||
|
"certificate_compression","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","none","",""
|
||||||
|
"clientAuth","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","none","",""
|
||||||
|
"cert_numbers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||||
|
"cert_serialNumber","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||||
|
"cert_serialNumberLen","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||||
|
"cert_fingerprintSHA256","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||||
|
"cert","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","*.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||||
|
"cert_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","63 >= 60 days","",""
|
||||||
|
"cert_notBefore","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2025-12-07 00:00","",""
|
||||||
|
"cert_notAfter","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2027-01-06 23:59","",""
|
||||||
|
"cert_extlifeSpan","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","",""
|
||||||
|
"cert_ocspURL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","http://ocsp.sectigo.com","",""
|
||||||
|
"OCSP_stapling","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","",""
|
||||||
|
"cert_mustStapleExtension","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","--","",""
|
||||||
|
"certificate_transparency","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","no","",""
|
||||||
|
"cert_caIssuers","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||||
|
"intermediate_cert <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2036-03-21 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||||
|
"intermediate_cert <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","2010-02-01 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert_badOCSP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","404 Not Found ('/')","",""
|
||||||
|
"HTTP_clock_skew","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","1793779861","",""
|
||||||
|
"HSTS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","not offered","",""
|
||||||
|
"HPKP","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No Server banner line in header, interesting!","",""
|
||||||
|
"banner_application","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","X-Powered-By: Express","",""
|
||||||
|
"cookie_count","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","0 at '/' (maybe missed the application)","",""
|
||||||
|
"Access-Control-Allow-Origin","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","*","",""
|
||||||
|
"banner_reverseproxy","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, mitigated","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM-common_primes","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","LOW","potentially vulnerable, uses obsolete TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_X","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_11_12","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_13_14","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-android_15","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-chrome_101_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-chromium_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-firefox_100_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-firefox_137_win11","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-ie_8_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-SHA256","",""
|
||||||
|
"clientsimulation-ie_11_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_15_win10","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_7u25","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1102","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1703","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_2106","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-go_1178","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-libressl_336","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_102e","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-openssl_111d","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"rating_spec","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","30","",""
|
||||||
|
"key_exchange_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","27","",""
|
||||||
|
"cipher_strength_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","36","",""
|
||||||
|
"final_score","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","INFO","93","",""
|
||||||
|
"overall_grade","shelly-infra1-eu.shelly.cloud/35.205.173.252","9443","OK","A+","",""
|
||||||
|
@@ -0,0 +1,242 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (35.205.173.252): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span><span style="color:#a86437;">offered</span>
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span><span style="color:#008817;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (server order)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH<span style="color:#008817;"> 253</span> AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH<span style="color:#008817;"> 253</span> AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
<u>TLSv1.3</u> (server order)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:#008817;font-weight:bold;">yes (OK)</span> -- TLS 1.3 and below
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">secp521r1</span> <span style="color:#008817;">X25519</span> <span style="color:#008817;">X448</span>
|
||||||
|
<span style="font-weight:bold;"> Finite field group: </span><span style="color:#008817;">ffdhe2048 ffdhe3072</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>7200 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets: yes, ID: no
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>(no "Server" line in header, interesting!)
|
||||||
|
<span style="font-weight:bold;"> Application banner </span><span style="color:#8a7237;font-weight:bold;">X-Powered-By</span>: Express'
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span> -- mitigated (disconnect after 4/10 attempts)
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span style="color:#008817;">not vulnerable (OK):</span> no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental potentially <span style="color:#a86437;">VULNERABLE</span>, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">X25519MLKEM768</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,841 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793779827",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "shelly-infra1-eu.shelly.cloud",
|
||||||
|
"ip" : "35.205.173.252",
|
||||||
|
"port" : "9443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc027",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc028",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc061",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc061 ECDHE-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc060",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc060 ECDHE-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc014",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc013",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09d",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc051",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc09c",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc050",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3d",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x3c",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x35",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x2f",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "TLSv1.2 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 ECDHE-ARIA128-GCM-SHA256 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES256-CCM ARIA256-GCM-SHA384 AES128-GCM-SHA256 AES128-CCM ARIA128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipherorder_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "prioritize_chacha_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "false"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "server"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "X25519MLKEM768"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 secp521r1 X25519 X448"
|
||||||
|
},{
|
||||||
|
"id" : "DH_groups",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ffdhe2048 ffdhe3072"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512 RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'max fragment length/#1' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'encrypt-then-mac/#22' 'extended master secret/#23' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "valid for 7200 seconds only (<daily)"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "63 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-12-07 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-06 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ocsp.sectigo.com"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2036-03-21 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2010-02-01 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "404 Not Found ('/')"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793779861"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No Server banner line in header, interesting!"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "X-Powered-By: Express"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "Access-Control-Allow-Origin",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, mitigated"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "no DH key with <= TLS 1.2"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "potentially vulnerable, uses obsolete TLS CBC ciphers"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 74
|
||||||
|
}
|
||||||
@@ -0,0 +1,221 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_infra_9443 shelly-infra1-eu.shelly.cloud:9443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 09:10:28 -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (35.205.173.252): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [m[1;33moffered[m
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [m[0;32moffered (OK)[m
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (server order)
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc027 ECDHE-RSA-AES128-SHA256 ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
xc028 ECDHE-RSA-AES256-SHA384 ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc061 ECDHE-ARIA256-GCM-SHA384 ECDH[0;32m 253[m ARIAGCM 256 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
xc060 ECDHE-ARIA128-GCM-SHA256 ECDH[0;32m 253[m ARIAGCM 128 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
xc014 ECDHE-RSA-AES256-SHA ECDH[0;32m 253[m AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
xc013 ECDHE-RSA-AES128-SHA ECDH[0;32m 253[m AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
|
||||||
|
xc051 ARIA256-GCM-SHA384 RSA ARIAGCM 256 TLS_RSA_WITH_ARIA_256_GCM_SHA384
|
||||||
|
x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
|
||||||
|
xc050 ARIA128-GCM-SHA256 RSA ARIAGCM 128 TLS_RSA_WITH_ARIA_128_GCM_SHA256
|
||||||
|
x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
|
||||||
|
x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
[4mTLSv1.3[m (server order)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH/MLKEM AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH/MLKEM ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH/MLKEM AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [m[1;32myes (OK)[m -- TLS 1.3 and below
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384
|
||||||
|
ECDHE-RSA-AES256-SHA ECDHE-RSA-CHACHA20-POLY1305
|
||||||
|
ECDHE-ARIA256-GCM-SHA384 TLS_AES_128_GCM_SHA256
|
||||||
|
ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256
|
||||||
|
ECDHE-RSA-AES128-SHA ECDHE-ARIA128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[0;32mX25519MLKEM768[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32msecp521r1[m [0;32mX25519[m [0;32mX448[m
|
||||||
|
[1m Finite field group: [m[0;32mffdhe2048 ffdhe3072[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
RSA+SHA256 RSA+SHA384 RSA+SHA512 RSA+SHA224
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"max fragment length/#1" "EC point formats/#11"
|
||||||
|
"application layer protocol negotiation/#16" "encrypt-then-mac/#22"
|
||||||
|
"extended master secret/#23" "session ticket/#35"
|
||||||
|
"supported versions/#43" "key share/#51" "renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [m7200 seconds, session tickets keys seems to be rotated < daily
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets: yes, ID: no
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [m--
|
||||||
|
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||||
|
[1m OCSP stapling [m[1;33mnot offered[m
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||||
|
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found")
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [m(no "Server" line in header, interesting!)
|
||||||
|
[1m Application banner [m[33m[1mX-Powered-By(B[m: Express
|
||||||
|
[1m Cookie(s) [m(none issued at "/") -- HTTP status 404 signals you maybe missed the web application
|
||||||
|
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m ROBOT [m[1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m -- mitigated (disconnect after 4/10 attempts)
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental [0;32mnot vulnerable (OK):[m no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental potentially [1;33mVULNERABLE[m, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32mX25519MLKEM768[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 09:11:41 [ 74s] -->> 35.205.173.252:9443 (shelly-infra1-eu.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,174 @@
|
|||||||
|
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||||
|
"service","repo.shelly.cloud/35.241.201.25","443","INFO","HTTP","",""
|
||||||
|
"pre_128cipher","repo.shelly.cloud/35.241.201.25","443","INFO","No 128 cipher limit bug","",""
|
||||||
|
"SSLv2","repo.shelly.cloud/35.241.201.25","443","OK","not offered","",""
|
||||||
|
"SSLv3","repo.shelly.cloud/35.241.201.25","443","OK","not offered","",""
|
||||||
|
"TLS1","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||||
|
"TLS1_1","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||||
|
"TLS1_2","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||||
|
"TLS1_3","repo.shelly.cloud/35.241.201.25","443","OK","offered with final","",""
|
||||||
|
"NPN","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||||
|
"ALPN","repo.shelly.cloud/35.241.201.25","443","INFO","http/1.1","",""
|
||||||
|
"cipherlist_NULL","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_aNULL","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_EXPORT","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_LOW","repo.shelly.cloud/35.241.201.25","443","OK","not offered","","CWE-327"
|
||||||
|
"cipherlist_3DES_IDEA","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_OBSOLETED","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","","CWE-310"
|
||||||
|
"cipherlist_STRONG_NOFS","repo.shelly.cloud/35.241.201.25","443","INFO","not offered","",""
|
||||||
|
"cipherlist_STRONG_FS","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||||
|
"cipher_order-tls1_2","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_2_xc030","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_x9f","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_2_xcca8","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xccaa","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_2_xc02f","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher-tls1_2_x9e","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_2","repo.shelly.cloud/35.241.201.25","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"cipher_order-tls1_3","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a cipher order configured","",""
|
||||||
|
"cipher-tls1_3_x1302","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"cipher-tls1_3_x1303","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"cipher-tls1_3_x1301","repo.shelly.cloud/35.241.201.25","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"supportedciphers_TLSv1_3","repo.shelly.cloud/35.241.201.25","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"cipher_order","repo.shelly.cloud/35.241.201.25","443","INFO","NOT a server cipher order configured","",""
|
||||||
|
"FS","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||||
|
"FS_ciphers","repo.shelly.cloud/35.241.201.25","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"FS_KEMs","repo.shelly.cloud/35.241.201.25","443","LOW","No KEMs offered","",""
|
||||||
|
"FS_ECDHE_curves","repo.shelly.cloud/35.241.201.25","443","OK","prime256v1 secp384r1 X25519","",""
|
||||||
|
"DH_groups","repo.shelly.cloud/35.241.201.25","443","OK","ffdhe2048","",""
|
||||||
|
"FS_TLS12_sig_algs","repo.shelly.cloud/35.241.201.25","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224","",""
|
||||||
|
"FS_TLS13_sig_algs","repo.shelly.cloud/35.241.201.25","443","INFO","RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256","",""
|
||||||
|
"TLS_extensions","repo.shelly.cloud/35.241.201.25","443","INFO","'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'","",""
|
||||||
|
"TLS_session_ticket","repo.shelly.cloud/35.241.201.25","443","INFO","no -- no lifetime advertised","",""
|
||||||
|
"SSL_sessionID_support","repo.shelly.cloud/35.241.201.25","443","INFO","yes","",""
|
||||||
|
"sessionresumption_ticket","repo.shelly.cloud/35.241.201.25","443","INFO","not supported","",""
|
||||||
|
"sessionresumption_ID","repo.shelly.cloud/35.241.201.25","443","INFO","supported","",""
|
||||||
|
"TLS_timestamp","repo.shelly.cloud/35.241.201.25","443","INFO","random","",""
|
||||||
|
"certificate_compression","repo.shelly.cloud/35.241.201.25","443","INFO","none","",""
|
||||||
|
"clientAuth","repo.shelly.cloud/35.241.201.25","443","INFO","none","",""
|
||||||
|
"cert_numbers","repo.shelly.cloud/35.241.201.25","443","INFO","1","",""
|
||||||
|
"cert_signatureAlgorithm","repo.shelly.cloud/35.241.201.25","443","OK","SHA256 with RSA","",""
|
||||||
|
"cert_keySize","repo.shelly.cloud/35.241.201.25","443","INFO","RSA 2048 bits (exponent is 65537)","",""
|
||||||
|
"cert_keyUsage","repo.shelly.cloud/35.241.201.25","443","INFO","Digital Signature, Key Encipherment","",""
|
||||||
|
"cert_extKeyUsage","repo.shelly.cloud/35.241.201.25","443","INFO","TLS Web Server Authentication, TLS Web Client Authentication","",""
|
||||||
|
"cert_serialNumber","repo.shelly.cloud/35.241.201.25","443","INFO","393425BF88EBDD03492962D4E9723D5E","",""
|
||||||
|
"cert_serialNumberLen","repo.shelly.cloud/35.241.201.25","443","INFO","16","",""
|
||||||
|
"cert_fingerprintSHA1","repo.shelly.cloud/35.241.201.25","443","INFO","CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7","",""
|
||||||
|
"cert_fingerprintSHA256","repo.shelly.cloud/35.241.201.25","443","INFO","CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","",""
|
||||||
|
"cert","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----","",""
|
||||||
|
"cert_commonName","repo.shelly.cloud/35.241.201.25","443","OK","*.shelly.cloud","",""
|
||||||
|
"cert_commonName_wo_SNI","repo.shelly.cloud/35.241.201.25","443","INFO","*.shelly.cloud","",""
|
||||||
|
"cert_subjectAltName","repo.shelly.cloud/35.241.201.25","443","INFO","*.shelly.cloud shelly.cloud","",""
|
||||||
|
"cert_trust","repo.shelly.cloud/35.241.201.25","443","OK","Ok via SAN wildcard and CN wildcard (same w/o SNI)","",""
|
||||||
|
"cert_trust_wildcard","repo.shelly.cloud/35.241.201.25","443","LOW","trust is via wildcard","",""
|
||||||
|
"cert_chain_of_trust","repo.shelly.cloud/35.241.201.25","443","OK","passed.","",""
|
||||||
|
"cert_certificatePolicies_EV","repo.shelly.cloud/35.241.201.25","443","INFO","no","",""
|
||||||
|
"cert_expirationStatus","repo.shelly.cloud/35.241.201.25","443","OK","63 >= 60 days","",""
|
||||||
|
"cert_notBefore","repo.shelly.cloud/35.241.201.25","443","INFO","2025-12-07 00:00","",""
|
||||||
|
"cert_notAfter","repo.shelly.cloud/35.241.201.25","443","OK","2027-01-06 23:59","",""
|
||||||
|
"cert_extlifeSpan","repo.shelly.cloud/35.241.201.25","443","OK","certificate has no extended life time according to browser forum","",""
|
||||||
|
"cert_eTLS","repo.shelly.cloud/35.241.201.25","443","INFO","not present","",""
|
||||||
|
"cert_crlDistributionPoints","repo.shelly.cloud/35.241.201.25","443","INFO","--","",""
|
||||||
|
"cert_ocspURL","repo.shelly.cloud/35.241.201.25","443","INFO","http://ocsp.sectigo.com","",""
|
||||||
|
"OCSP_stapling","repo.shelly.cloud/35.241.201.25","443","OK","offered","",""
|
||||||
|
"cert_ocspRevoked","repo.shelly.cloud/35.241.201.25","443","OK","not revoked","",""
|
||||||
|
"cert_mustStapleExtension","repo.shelly.cloud/35.241.201.25","443","INFO","--","",""
|
||||||
|
"DNS_CAArecord","repo.shelly.cloud/35.241.201.25","443","LOW","--","",""
|
||||||
|
"certificate_transparency","repo.shelly.cloud/35.241.201.25","443","OK","yes (certificate extension)","",""
|
||||||
|
"certs_countServer","repo.shelly.cloud/35.241.201.25","443","INFO","4","",""
|
||||||
|
"certs_list_ordering_problem","repo.shelly.cloud/35.241.201.25","443","INFO","no","",""
|
||||||
|
"cert_caIssuers","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)","",""
|
||||||
|
"intermediate_cert <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0","",""
|
||||||
|
"intermediate_cert_notBefore <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#1>","repo.shelly.cloud/35.241.201.25","443","OK","2036-03-21 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#1>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#1>","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46","",""
|
||||||
|
"intermediate_cert <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5","",""
|
||||||
|
"intermediate_cert_notBefore <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","2021-03-22 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#2>","repo.shelly.cloud/35.241.201.25","443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#2>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#2>","repo.shelly.cloud/35.241.201.25","443","INFO","Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----","",""
|
||||||
|
"intermediate_cert_fingerprintSHA256 <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2","",""
|
||||||
|
"intermediate_cert_notBefore <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","2010-02-01 00:00","",""
|
||||||
|
"intermediate_cert_notAfter <#3>","repo.shelly.cloud/35.241.201.25","443","OK","2038-01-18 23:59","",""
|
||||||
|
"intermediate_cert_expiration <#3>","repo.shelly.cloud/35.241.201.25","443","OK","ok > 40 days","",""
|
||||||
|
"intermediate_cert_chain <#3>","repo.shelly.cloud/35.241.201.25","443","INFO","USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority","",""
|
||||||
|
"intermediate_cert_badOCSP","repo.shelly.cloud/35.241.201.25","443","OK","intermediate certificate(s) is/are ok","",""
|
||||||
|
"HTTP_status_code","repo.shelly.cloud/35.241.201.25","443","INFO","401 Unauthorized ('/') --","",""
|
||||||
|
"HTTP_clock_skew","repo.shelly.cloud/35.241.201.25","443","INFO","0 seconds from localtime","",""
|
||||||
|
"HTTP_headerTime","repo.shelly.cloud/35.241.201.25","443","INFO","1793780243","",""
|
||||||
|
"HSTS","repo.shelly.cloud/35.241.201.25","443","LOW","not offered","",""
|
||||||
|
"HPKP","repo.shelly.cloud/35.241.201.25","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||||
|
"banner_server","repo.shelly.cloud/35.241.201.25","443","INFO","nginx/1.24.0 (Ubuntu)","",""
|
||||||
|
"banner_application","repo.shelly.cloud/35.241.201.25","443","INFO","No application banner found","",""
|
||||||
|
"cookie_count","repo.shelly.cloud/35.241.201.25","443","INFO","0 at '/' (maybe missed the application)","",""
|
||||||
|
"Access-Control-Allow-Origin","repo.shelly.cloud/35.241.201.25","443","INFO","*","",""
|
||||||
|
"banner_reverseproxy","repo.shelly.cloud/35.241.201.25","443","INFO","--","","CWE-200"
|
||||||
|
"heartbleed","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||||
|
"CCS","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||||
|
"ticketbleed","repo.shelly.cloud/35.241.201.25","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||||
|
"ROBOT","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||||
|
"secure_renego","repo.shelly.cloud/35.241.201.25","443","OK","supported","","CWE-310"
|
||||||
|
"secure_client_renego","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||||
|
"CRIME_TLS","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||||
|
"BREACH","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||||
|
"POODLE_SSL","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||||
|
"fallback_SCSV","repo.shelly.cloud/35.241.201.25","443","OK","no protocol below TLS 1.2 offered","",""
|
||||||
|
"SWEET32","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||||
|
"FREAK","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||||
|
"DROWN","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"DROWN_hint","repo.shelly.cloud/35.241.201.25","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||||
|
"LOGJAM-common_primes","repo.shelly.cloud/35.241.201.25","443","INFO","RFC7919/ffdhe2048","CVE-2015-4000","CWE-310"
|
||||||
|
"LOGJAM","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||||
|
"BEAST","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20"
|
||||||
|
"LUCKY13","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2013-0169","CWE-310"
|
||||||
|
"winshock","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||||
|
"RC4","repo.shelly.cloud/35.241.201.25","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||||
|
"clientsimulation-android_70","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_81","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||||
|
"clientsimulation-android_90","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_X","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_11_12","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_13_14","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-android_15","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chrome_101_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-chromium_137_win11","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_100_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-firefox_137_win11","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-ie_8_win7","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win7","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_win81","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-ie_11_winphone81","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-ie_11_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_15_win10","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-edge_101_win10_21h2","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-edge_133_win11_23h2","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_ios_184","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_154_osx_1231","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-safari_184_osx_154","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_7u25","repo.shelly.cloud/35.241.201.25","443","INFO","No connection","",""
|
||||||
|
"clientsimulation-java_80442","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_1102","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-java_1703","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-java_2106","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-go_1178","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"clientsimulation-libressl_336","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||||
|
"clientsimulation-openssl_102e","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-openssl_111d","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_315","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-openssl_350","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||||
|
"clientsimulation-apple_mail_16_0","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||||
|
"clientsimulation-thunderbird_91_9","repo.shelly.cloud/35.241.201.25","443","INFO","TLSv1.3 TLS_AES_128_GCM_SHA256","",""
|
||||||
|
"rating_spec","repo.shelly.cloud/35.241.201.25","443","INFO","SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)","",""
|
||||||
|
"rating_doc","repo.shelly.cloud/35.241.201.25","443","INFO","https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide","",""
|
||||||
|
"protocol_support_score","repo.shelly.cloud/35.241.201.25","443","INFO","100","",""
|
||||||
|
"protocol_support_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","30","",""
|
||||||
|
"key_exchange_score","repo.shelly.cloud/35.241.201.25","443","INFO","90","",""
|
||||||
|
"key_exchange_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","27","",""
|
||||||
|
"cipher_strength_score","repo.shelly.cloud/35.241.201.25","443","INFO","90","",""
|
||||||
|
"cipher_strength_score_weighted","repo.shelly.cloud/35.241.201.25","443","INFO","36","",""
|
||||||
|
"final_score","repo.shelly.cloud/35.241.201.25","443","INFO","93","",""
|
||||||
|
"overall_grade","repo.shelly.cloud/35.241.201.25","443","OK","A+","",""
|
||||||
|
@@ -0,0 +1,229 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8" ?>
|
||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||||
|
<!-- This file was created with testssl.sh. https://testssl.sh -->
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
|
||||||
|
<title>testssl.sh</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<pre>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
#####################################################################</span>
|
||||||
|
<span style="font-weight:bold;">testssl</span> version <span style="font-weight:bold;">3.2.4</span> from <a href="https://testssl.sh/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/</a>
|
||||||
|
<span style="font-weight:bold;">
|
||||||
|
This program is free software. Distribution and modification under
|
||||||
|
GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!</span>
|
||||||
|
|
||||||
|
Please file bugs @ <a href="https://testssl.sh/bugs/" style="font-weight:bold;color:black;text-decoration:none;">https://testssl.sh/bugs/</a>
|
||||||
|
<span style="font-weight:bold;">#####################################################################</span>
|
||||||
|
|
||||||
|
Using <i>OpenSSL 3.6.5 (Sep 29 2026)</i> [~103 ciphers]
|
||||||
|
on kali:/usr/bin/openssl
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Start 2026-11-04 09:16:54 -->> 35.241.201.25:443 (repo.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
rDNS (35.241.201.25): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><u>via sockets except NPN+ALPN </u>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> SSLv2 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> SSLv3 </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.1 </span>not offered
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>: final
|
||||||
|
<span style="font-weight:bold;"> NPN/SPDY </span>not offered
|
||||||
|
<span style="font-weight:bold;"> ALPN/HTTP2 </span>http/1.1 (offered)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing cipher categories </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> NULL ciphers (no encryption) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Anonymous NULL Ciphers (no authentication) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Export ciphers (w/o ADH+NULL) </span><span style="color:#008817;font-weight:bold;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) </span><span style="color:#008817;">not offered (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Triple DES Ciphers / IDEA </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Obsoleted CBC ciphers (AES, ARIA etc.) </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Strong encryption (AEAD ciphers) with no FS </span>not offered
|
||||||
|
<span style="font-weight:bold;"> Forward Secrecy strong encryption (AEAD ciphers) </span><span style="color:#008817;font-weight:bold;">offered (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server's cipher preferences </span>
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
<u>SSLv2</u>
|
||||||
|
-
|
||||||
|
<u>SSLv3</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.1</u>
|
||||||
|
-
|
||||||
|
<u>TLSv1.2</u> (no server order, thus listed by strength)
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x9f DHE-RSA-AES256-GCM-SHA384 DH<span style="color:#008817;"> 2048</span> AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xccaa DHE-RSA-CHACHA20-POLY1305 DH<span style="color:#008817;"> 2048</span> ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9e DHE-RSA-AES128-GCM-SHA256 DH<span style="color:#008817;"> 2048</span> AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
<u>TLSv1.3</u> (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH<span style="color:#008817;"> 253</span> AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH<span style="color:#008817;"> 253</span> ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH<span style="color:#008817;"> 253</span> AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Has server cipher order? </span>no
|
||||||
|
(limited sense as client will pick)
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing robust forward secrecy (FS)</span><u> -- omitting Null Authentication/Encryption, 3DES, RC4 </u>
|
||||||
|
|
||||||
|
<span style="color:#008817;"> FS is offered (OK) </span> TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||||
|
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||||
|
DHE-RSA-AES128-GCM-SHA256
|
||||||
|
<span style="font-weight:bold;"> KEMs offered </span><span style="color:#a86437;">None</span>
|
||||||
|
<span style="font-weight:bold;"> Elliptic curves offered: </span><span style="color:#008817;">prime256v1</span> <span style="color:#008817;">secp384r1</span> <span style="color:#008817;">X25519</span>
|
||||||
|
<span style="font-weight:bold;"> DH group offered: </span><span style="color:#008817;">ffdhe2048</span>
|
||||||
|
<span style="font-weight:bold;"> TLS 1.2 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||||
|
<span style="font-weight:bold;"> TLS 1.3 sig_algs offered: </span>RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing server defaults (Server Hello) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> TLS extensions (standard) </span>"server name/#0" "max fragment length/#1" "status request/#5"
|
||||||
|
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "supported versions/#43"
|
||||||
|
"key share/#51" "renegotiation info/#65281"
|
||||||
|
<span style="font-weight:bold;"> Session Ticket RFC 5077 hint </span>no -- no lifetime advertised
|
||||||
|
<span style="font-weight:bold;"> SSL Session ID support </span>yes
|
||||||
|
<span style="font-weight:bold;"> Session Resumption </span>Tickets no, ID: yes
|
||||||
|
<span style="font-weight:bold;"> TLS clock skew</span> Random values, no fingerprinting possible
|
||||||
|
<span style="font-weight:bold;"> Certificate Compression </span>none
|
||||||
|
<span style="font-weight:bold;"> Client Authentication </span>none
|
||||||
|
<span style="font-weight:bold;"> Signature Algorithm </span><span style="color:#008817;">SHA256 with RSA</span>
|
||||||
|
<span style="font-weight:bold;"> Server key size </span>RSA 2048 bits (exponent is 65537)
|
||||||
|
<span style="font-weight:bold;"> Server key usage </span>Digital Signature, Key Encipherment
|
||||||
|
<span style="font-weight:bold;"> Server extended key usage </span>TLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
<span style="font-weight:bold;"> Serial </span>393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
<span style="font-weight:bold;"> Fingerprints </span>SHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Common Name (CN) </span><i>*.shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> subjectAltName (SAN) </span><i>*.shelly.cloud shelly.cloud </i>
|
||||||
|
<span style="font-weight:bold;"> Trust (hostname) </span><span style="color:#008817;">Ok via SAN wildcard and CN wildcard</span> (same w/o SNI)
|
||||||
|
<span style="color:#a86437;">wildcard certificate</span> could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
<span style="font-weight:bold;"> Chain of trust</span> <span style="color:#008817;">Ok </span><span style="color:#cd00cd;"></span>
|
||||||
|
<span style="font-weight:bold;"> EV cert</span> (experimental) no
|
||||||
|
<span style="font-weight:bold;"> Certificate Validity (UTC) </span><span style="color:#008817;">63 >= 60 days</span> (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
<span style="font-weight:bold;"> ETS/"eTLS"</span>, visibility info not present
|
||||||
|
<span style="font-weight:bold;"> Certificate Revocation List </span>--
|
||||||
|
<span style="font-weight:bold;"> OCSP URI </span>http://ocsp.sectigo.com
|
||||||
|
<span style="font-weight:bold;"> OCSP stapling </span><span style="color:#008817;">offered</span>, <span style="color:#008817;">not revoked</span>
|
||||||
|
<span style="font-weight:bold;"> OCSP must staple extension </span>--
|
||||||
|
<span style="font-weight:bold;"> DNS CAA RR</span> (experimental) <span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Certificate Transparency </span><span style="color:#008817;">yes</span> (certificate extension)
|
||||||
|
<span style="font-weight:bold;"> Certificates provided</span> 4
|
||||||
|
<span style="font-weight:bold;"> Issuer </span><i>Sectigo Public Server Authentication CA DV R36</i> (<i>Sectigo Limited</i> from <i>GB</i>)
|
||||||
|
<span style="font-weight:bold;"> Intermediate cert validity </span>#1: <span style="color:#008817;">ok > 40 days</span> (2036-03-21 23:59). <i>Sectigo Public Server Authentication CA DV R36</i> <-- <i>Sectigo Public Server Authentication Root R46</i>
|
||||||
|
#2: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>Sectigo Public Server Authentication Root R46</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
#3: <span style="color:#008817;">ok > 40 days</span> (2038-01-18 23:59). <i>USERTrust RSA Certification Authority</i> <-- <i>USERTrust RSA Certification Authority</i>
|
||||||
|
<span style="font-weight:bold;"> Intermediate Bad OCSP</span> (exp.) <span style="color:#008817;">Ok</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> HTTP Status Code </span> 401 Unauthorized
|
||||||
|
<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
|
||||||
|
<span style="font-weight:bold;"> Strict Transport Security </span><span style="color:#a86437;">not offered</span>
|
||||||
|
<span style="font-weight:bold;"> Public Key Pinning </span>--
|
||||||
|
<span style="font-weight:bold;"> Server banner </span>nginx/<span style="color:#8a7237;">1</span>.<span style="color:#8a7237;">2</span><span style="color:#8a7237;">4</span>.<span style="color:#8a7237;">0</span> (<span style="color:#8a7237;font-weight:bold;">Ubuntu</span>)'
|
||||||
|
<span style="font-weight:bold;"> Application banner </span>--
|
||||||
|
<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||||
|
<span style="font-weight:bold;"> Security headers </span>Access-Control-Allow-Origin: *
|
||||||
|
<span style="font-weight:bold;"> Reverse Proxy banner </span>--
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no heartbeat extension
|
||||||
|
<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Ticketbleed</span> (CVE-2016-9244), experiment. <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no session ticket extension
|
||||||
|
<span style="font-weight:bold;"> ROBOT </span><span style="color:#008817;font-weight:bold;">Server does not support any cipher suites that use RSA key transport</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Renegotiation (RFC 5746) </span><span style="color:#008817;font-weight:bold;">supported (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span style="color:#008817;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span style="color:#008817;">no gzip/deflate/compress/br HTTP compression (OK) </span> - only supplied "/" tested
|
||||||
|
<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>, no SSLv3 support
|
||||||
|
<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507) <span style="color:#008817;">No fallback possible (OK)</span>, no protocol below TLS 1.2 offered
|
||||||
|
<span style="font-weight:bold;"> SWEET32</span> (CVE-2016-2183, CVE-2016-6329) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> DROWN</span> (CVE-2016-0800, CVE-2016-0703) <span style="color:#008817;font-weight:bold;">not vulnerable on this host and port (OK)</span>
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
<a href="https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867" style="color:black;text-decoration:none;">https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867</a>
|
||||||
|
<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental common prime with 2048 bits detected: <i>RFC7919/ffdhe2048</i> (<span style="color:#008817;">2048 bits</span>),
|
||||||
|
but no DH EXPORT ciphers
|
||||||
|
<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) <span style="color:#008817;">not vulnerable (OK)</span>, no SSL3 or TLS1
|
||||||
|
<span style="font-weight:bold;"> LUCKY13</span> (CVE-2013-0169), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> Winshock</span> (CVE-2014-6321), experimental <span style="color:#008817;font-weight:bold;">not vulnerable (OK)</span>
|
||||||
|
<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span style="color:#008817;">no RC4 ciphers detected (OK)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Running client simulations </span><span style="text-decoration:underline;font-weight:bold;">(HTTP) </span><span style="text-decoration:underline;font-weight:bold;">via sockets </span>
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||||
|
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">2048 bit DH (ffdhe2048)</span>
|
||||||
|
IE 11 Win Phone 8.1 No connection
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 <span style="color:#008817;">256 bit ECDH (P-256)</span>
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 <span style="color:#008817;">253 bit ECDH (X25519)</span>
|
||||||
|
|
||||||
|
|
||||||
|
<span style="text-decoration:underline;font-weight:bold;"> Rating (experimental) </span>
|
||||||
|
|
||||||
|
<span style="font-weight:bold;"> Rating specs</span> (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
<span style="font-weight:bold;"> Specification documentation </span><a href="https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide" style="color:black;text-decoration:none;">https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide</a>
|
||||||
|
<span style="font-weight:bold;"> Protocol Support </span>(weighted) 100 (30)
|
||||||
|
<span style="font-weight:bold;"> Key Exchange </span> (weighted) 90 (27)
|
||||||
|
<span style="font-weight:bold;"> Cipher Strength </span> (weighted) 90 (36)
|
||||||
|
<span style="font-weight:bold;"> Final Score </span>93
|
||||||
|
<span style="font-weight:bold;"> Overall Grade </span><span style="color:#008817;font-weight:bold;">A+</span>
|
||||||
|
|
||||||
|
<span style="color:white;background-color:black;"> Done 2026-11-04 09:17:46 [ 53s] -->> 35.241.201.25:443 (repo.shelly.cloud) <<--</span>
|
||||||
|
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,785 @@
|
|||||||
|
{
|
||||||
|
"Invocation" : "testssl -oA testssl/des08_shelly_repo repo.shelly.cloud:443",
|
||||||
|
"at" : "kali:/usr/bin/openssl",
|
||||||
|
"version" : "3.2.4 ",
|
||||||
|
"openssl" : "OpenSSL 3.6.5 from Tue Sep 29 19:39:32 2026",
|
||||||
|
"startTime" : "1793780213",
|
||||||
|
"scanResult" : [
|
||||||
|
{
|
||||||
|
"targetHost" : "repo.shelly.cloud",
|
||||||
|
"ip" : "35.241.201.25",
|
||||||
|
"port" : "443",
|
||||||
|
"rDNS" : "--",
|
||||||
|
"service" : "HTTP",
|
||||||
|
"pretest" : [
|
||||||
|
{
|
||||||
|
"id" : "pre_128cipher",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No 128 cipher limit bug"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"protocols" : [
|
||||||
|
{
|
||||||
|
"id" : "SSLv2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "SSLv3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_2",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "TLS1_3",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered with final"
|
||||||
|
},{
|
||||||
|
"id" : "NPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "ALPN",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http/1.1"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"grease" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"ciphers" : [
|
||||||
|
{
|
||||||
|
"id" : "cipherlist_NULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_aNULL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_EXPORT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_LOW",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_3DES_IDEA",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_OBSOLETED",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_NOFS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "cipherlist_STRONG_FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverPreferences" : [
|
||||||
|
{
|
||||||
|
"id" : "cipher_order-tls1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc030",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xcca8",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xccaa",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_xc02f",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_2_x9e",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order-tls1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a cipher order configured"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1302",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1303",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher-tls1_3_x1301",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "supportedciphers_TLSv1_3",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_order",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "NOT a server cipher order configured"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"fs" : [
|
||||||
|
{
|
||||||
|
"id" : "FS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ciphers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "FS_KEMs",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "No KEMs offered"
|
||||||
|
},{
|
||||||
|
"id" : "FS_ECDHE_curves",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "prime256v1 secp384r1 X25519"
|
||||||
|
},{
|
||||||
|
"id" : "DH_groups",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ffdhe2048"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS12_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224"
|
||||||
|
},{
|
||||||
|
"id" : "FS_TLS13_sig_algs",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"serverDefaults" : [
|
||||||
|
{
|
||||||
|
"id" : "TLS_extensions",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "'server name/#0' 'max fragment length/#1' 'status request/#5' 'EC point formats/#11' 'application layer protocol negotiation/#16' 'extended master secret/#23' 'supported versions/#43' 'key share/#51' 'renegotiation info/#65281'"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_session_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no -- no lifetime advertised"
|
||||||
|
},{
|
||||||
|
"id" : "SSL_sessionID_support",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "yes"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ticket",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not supported"
|
||||||
|
},{
|
||||||
|
"id" : "sessionresumption_ID",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "TLS_timestamp",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "random"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_compression",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "clientAuth",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "none"
|
||||||
|
},{
|
||||||
|
"id" : "cert_numbers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1"
|
||||||
|
},{
|
||||||
|
"id" : "cert_signatureAlgorithm",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "SHA256 with RSA"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keySize",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "RSA 2048 bits (exponent is 65537)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_keyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Digital Signature, Key Encipherment"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extKeyUsage",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLS Web Server Authentication, TLS Web Client Authentication"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumber",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "393425BF88EBDD03492962D4E9723D5E"
|
||||||
|
},{
|
||||||
|
"id" : "cert_serialNumberLen",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "16"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA1",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7"
|
||||||
|
},{
|
||||||
|
"id" : "cert_fingerprintSHA256",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "cert",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlDCCBPygAwIBAgIQOTQlv4jr3QNJKWLU6XI9XjANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MB4XDTI1MTIwNzAwMDAwMFoXDTI3MDEwNjIzNTk1OVowGTEXMBUGA1UEAwwOKi5zaGVsbHkuY2xvdWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHiH39QssX3SAOktCH9+jF1Yg75XoVKPXBjyUslZchmGTHgaL0plMNI5Z9KcQF2HtTycCI9mm/DCVFVj64VW6LNECxi7vZo3j+QuQTcrQXIWqnNXzGxPHsaCaorohO/f2pr+3T9dwkhFpYxoyIBmG7bDC/+3dpXVgKvTr+2qfA0AZLHTVkEnANDiJmD71uOzDEsKGbNvPh+bEcejQ1U6oMYfSjokc8kQWZAtYQrSjoWFRlEGSyQ9w4Ycs9Fkj1jm5S38QinUL9f/e2ixOcIro4grGiEPBo1F0TlXZdJA+UNwWhvR6lGBPt2u9CeLqbFT9EMxYLzkk4BVSbwwo4QYUpAgMBAAGjggMPMIIDCzAfBgNVHSMEGDAWgBRowBIWGA6vzvaHpjJXo0ZRXcsHJzAdBgNVHQ4EFgQUK4d3ktg3tGUadLF7ElmwlNUWI84wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARCMEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uQ0FEVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCcGA1UdEQQgMB6CDiouc2hlbGx5LmNsb3VkggxzaGVsbHkuY2xvdWQwggGPBgorBgEEAdZ5AgQCBIIBfwSCAXsBeQB3AGBMmq96f3dfAdQG/JINyJnrCxx9+MlSG/r6F3c7l4vJAAABmvhKglAAAAQDAEgwRgIhALe6w6PGj2VMrnzVrEgCcyY31hRFXOs1Zo3gfDYct8FEAiEAhoW9j9o74TnX0vqLd+M+D6czMmmRlVSnXsY9wXh7T/UAfQCOykcLrN5q86IGsKR6hLdG/h/Gv5U+JeabTuQCSPPG6AAAAZr4SoM5AAgAAAUAAF40pwQDAEYwRAIgd4A8zJlZFIrZOsag2+LB4/5ddr94fM3bWjN179qY7YcCICrHSry2CSK45l9tCHyniUJEjGdFZ6om+P5iBVnBHJe0AH8AWW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lkAAAGa+EqDegAIAAAFAAAAtMYEAwBIMEYCIQCrhvthUcFm+QO87fYGWd1nmA5h880g4/lr5T8EqVdxFgIhAPbP6CYVvN62xyTBuJ9atFiugnNvWF4X7In5RJIsI0fJMA0GCSqGSIb3DQEBCwUAA4IBgQADL8JrZH0FQoHi8K3u5sZ4W1nVlTBog7LgXvSEdWg3CXUFcfcQH6SZ92X59+s4IONKnRfGxgsq8Y5scmcL6ea9lfKJ0/rKoc1tRvBlMziNnX49pIrUjuMaCRyc1sBHV8KHOVAFTt81lqMpieTx36vm7xxcMxVoM3VRucc0iluxgYVoMZ0cd8+Hf/nX5vwBZerjbuNvoGpmNTs66Ym0E7DU8DqPSY6pFyGXscYtjm+fm5E5xoxPgScjVUW2GCPw6yejARjF76n0JPAibeTlgN4IY/FBwh7A3HI43bFgVYrucCfzwdqWe5g5YORqiTCizgzU1NDZEUYQVp86arT37W2z+7X6faszJhKK9kOPlWoybEIQ6ogFo4glqb3CQm2pSqxmCfz/+gXofkxaJc43W1SqLveoAFpbOYT5wOHc+M0SoecJT3AYz6JzxjAkJ7JNKMHf/iWNnmm36mDqMmWG1W6svoekCtyMcHjeWREjdyzabUTRVezuarw55JR9+dovV6w=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_commonName_wo_SNI",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_subjectAltName",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*.shelly.cloud shelly.cloud"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "Ok via SAN wildcard and CN wildcard (same w/o SNI)"
|
||||||
|
},{
|
||||||
|
"id" : "cert_trust_wildcard",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "trust is via wildcard"
|
||||||
|
},{
|
||||||
|
"id" : "cert_chain_of_trust",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "passed."
|
||||||
|
},{
|
||||||
|
"id" : "cert_certificatePolicies_EV",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_expirationStatus",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "63 >= 60 days"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notBefore",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2025-12-07 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "cert_notAfter",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2027-01-06 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "cert_extlifeSpan",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "certificate has no extended life time according to browser forum"
|
||||||
|
},{
|
||||||
|
"id" : "cert_eTLS",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "not present"
|
||||||
|
},{
|
||||||
|
"id" : "cert_crlDistributionPoints",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspURL",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "http://ocsp.sectigo.com"
|
||||||
|
},{
|
||||||
|
"id" : "OCSP_stapling",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "offered"
|
||||||
|
},{
|
||||||
|
"id" : "cert_ocspRevoked",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "not revoked"
|
||||||
|
},{
|
||||||
|
"id" : "cert_mustStapleExtension",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "DNS_CAArecord",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "--"
|
||||||
|
},{
|
||||||
|
"id" : "certificate_transparency",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "yes (certificate extension)"
|
||||||
|
},{
|
||||||
|
"id" : "certs_countServer",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "4"
|
||||||
|
},{
|
||||||
|
"id" : "certs_list_ordering_problem",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "no"
|
||||||
|
},{
|
||||||
|
"id" : "cert_caIssuers",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 (Sectigo Limited from GB)"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBfMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwHhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7YeqRPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAjaEMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTmM64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HBpXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFNxx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hklfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAYtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+dq1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OFh2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOdunQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzWr8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvhJEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "8C54C334B66BA4E426772AF4A3F9136C19A1AEC729FDB28C535C07A5A4EF22E0"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2036-03-21 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#1>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#1>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication CA DV R36 <-- Sectigo Public Server Authentication Root R46"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIGlTCCBH2gAwIBAgIRANJ/u8HeNZ5SFq1hSVhgmcQwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIxMDMyMjAwMDAwMFoXDTM4MDExODIzNTk1OVowXzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UEAxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk77VNlJ12AEjoBxHQknuY7a3If3EldVIKyZ8FFMQ2nn9K7ctpNQs+uoy3UnCub0PSD17WphUr55dMXRPB/xQId2kz2hPGxJjbSWZTCqZ80gwYfqBfB6nCErcPiscHxhMcao1jK34bug7StnllALWiYQTqm3ITzPMUJY3kjPcX4jnn1TZSPCYQ9Zm/Z8XOEPFAVEL1+MjDxRdWxTnS77d9MjaAzfR1jmhIVEwg7Bt1zBOlluR8HAkq79FgWRDDb0hOi886Z4NyyC1QifM2m+b7mQwkDnNk2WBITG1I1AzNyLjOO34MTDMRf5i+dFdMnlCh99qzFYZQE3Oqrv5tXZJlPEn+JGlg+UGs2MOgNzgElWApjtmtDmHLcjw0NEU6eQNTQ72XVdyxTscR1ad4tX7gWGMzE2AkDRbt9cUddzYBEifwMEoiLTpHMqnsfFWt3tJTFnlIBWohAIp+jiUaZpJBo/NH3kUFxIMg3reH7GX7vmXeCikyESS6X0mBaZYcpt5E9gRX67FOGI0aLKGMI74kGGeMmz1BzbNokxu7Io27fLmmRVEcMN8vJw5wLTha/eDJSNX2RKA5UnwdQ/vjescm1QotCE8/HwK/+97a3X/ix2gGQWr+vgrgULoOLq7+6r9PeDzyt9Ol5cp7fMYVumllqy9w5CYsuD5otSmR0N8bc8CAwEAAaOCASAwggEcMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRWc1hklfmSGrASKgRieaFAFYghSTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBADpvBIlq7bMU0cFDT/9P9+BsgCkRgQs0S6Bf7vJSlWMHwby0VGvxCS0hrbi0K2BINZbEbsVsgpQq04431yyoVn3Hldorgq24RldRDOOipEZDTFB9wC9HYt1thHF00XeG2C8KC1plwoEzKAIhPvefI/C3cT0CfTXJuFjUbKIgSwjNjw6YHtLgoy/hd5+JLUlLco/gzFX/qWbT7tEquOMYpsNKWZj8TLqPq6zMiG4Na6feEZte6YPXGrMWlTWN341vDedc+yxQqSug79HJUQcOZs7KyDWztmaeQxsPE49UV/8XwrfZtZaYyrs4FpD94Z4Q8dzXGL8+qEJjxgcza7W6PROaClubavd1VKPm8+aCW77u7SxpR2TFGL6kPdxsKyFijpcunR5V79sUyROfNdzjrAcFWZXK8sbb9FlnwuVG677JLv+ZVTX5AxLvW5OB4zt5uS+zB62wJ/Wv+jXGAttSAcJec4iFgCWHRvdi/jJoSzRLa3nEzx6pFIzclSCnh0u1xCeLcUBypSiPga8W+6PkuoyQq8U9qs9EoxG5NvrvlyshwUS9yvcZRGw7Ljlx4jJH/BhIPR8kIBCQj1vna9TziZOrw1Of8hDUbHKFG9Pm8Dp2vbjz/2JH39qvxshPKVllGfq+5klPm7yZRUYTiCMAbqwNdL/nsqF2Rnnyp58XRStJ\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "92F351BF3D54164DFA8DD8F9E1139D3150349786485D2B9EECD00E2971C1E6C5"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2021-03-22 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#2>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#2>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "Sectigo Public Server Authentication Root R46 <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "-----BEGIN CERTIFICATE-----\nMIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfGjjxDah2nGN59PRbxYvnKkKj9\n-----END CERTIFICATE-----"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_fingerprintSHA256 <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notBefore <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "2010-02-01 00:00"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_notAfter <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "2038-01-18 23:59"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_expiration <#3>",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "ok > 40 days"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_chain <#3>",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "USERTrust RSA Certification Authority <-- USERTrust RSA Certification Authority"
|
||||||
|
},{
|
||||||
|
"id" : "intermediate_cert_badOCSP",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "intermediate certificate(s) is/are ok"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"headerResponse" : [
|
||||||
|
{
|
||||||
|
"id" : "HTTP_status_code",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "401 Unauthorized ('/') --"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_clock_skew",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 seconds from localtime"
|
||||||
|
},{
|
||||||
|
"id" : "HTTP_headerTime",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "1793780243"
|
||||||
|
},{
|
||||||
|
"id" : "HSTS",
|
||||||
|
"severity" : "LOW",
|
||||||
|
"finding" : "not offered"
|
||||||
|
},{
|
||||||
|
"id" : "HPKP",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No support for HTTP Public Key Pinning"
|
||||||
|
},{
|
||||||
|
"id" : "banner_server",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "nginx/1.24.0 (Ubuntu)"
|
||||||
|
},{
|
||||||
|
"id" : "banner_application",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No application banner found"
|
||||||
|
},{
|
||||||
|
"id" : "cookie_count",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "0 at '/' (maybe missed the application)"
|
||||||
|
},{
|
||||||
|
"id" : "Access-Control-Allow-Origin",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "*"
|
||||||
|
},{
|
||||||
|
"id" : "banner_reverseproxy",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "--"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"vulnerabilities" : [
|
||||||
|
{
|
||||||
|
"id" : "heartbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0160",
|
||||||
|
"cwe" : "CWE-119",
|
||||||
|
"finding" : "not vulnerable, no heartbeat extension"
|
||||||
|
},{
|
||||||
|
"id" : "CCS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-0224",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "ticketbleed",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-9244",
|
||||||
|
"cwe" : "CWE-200",
|
||||||
|
"finding" : "no session ticket extension"
|
||||||
|
},{
|
||||||
|
"id" : "ROBOT",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168",
|
||||||
|
"cwe" : "CWE-203",
|
||||||
|
"finding" : "not vulnerable, no RSA key transport cipher"
|
||||||
|
},{
|
||||||
|
"id" : "secure_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "supported"
|
||||||
|
},{
|
||||||
|
"id" : "secure_client_renego",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-1473",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "CRIME_TLS",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2012-4929",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "BREACH",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-3587",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested"
|
||||||
|
},{
|
||||||
|
"id" : "POODLE_SSL",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-3566",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no SSLv3"
|
||||||
|
},{
|
||||||
|
"id" : "fallback_SCSV",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "no protocol below TLS 1.2 offered"
|
||||||
|
},{
|
||||||
|
"id" : "SWEET32",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-2183 CVE-2016-6329",
|
||||||
|
"cwe" : "CWE-327",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "FREAK",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-0204",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable on this host and port"
|
||||||
|
},{
|
||||||
|
"id" : "DROWN_hint",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2016-0800 CVE-2016-0703",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM-common_primes",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "RFC7919/ffdhe2048"
|
||||||
|
},{
|
||||||
|
"id" : "LOGJAM",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2015-4000",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable, no DH EXPORT ciphers,"
|
||||||
|
},{
|
||||||
|
"id" : "BEAST",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2011-3389",
|
||||||
|
"cwe" : "CWE-20",
|
||||||
|
"finding" : "not vulnerable, no SSL3 or TLS1"
|
||||||
|
},{
|
||||||
|
"id" : "LUCKY13",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-0169",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "winshock",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2014-6321",
|
||||||
|
"cwe" : "CWE-94",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
},{
|
||||||
|
"id" : "RC4",
|
||||||
|
"severity" : "OK",
|
||||||
|
"cve" : "CVE-2013-2566 CVE-2015-2808",
|
||||||
|
"cwe" : "CWE-310",
|
||||||
|
"finding" : "not vulnerable"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cipherTests" : [
|
||||||
|
|
||||||
|
],
|
||||||
|
"browserSimulations": [
|
||||||
|
{
|
||||||
|
"id" : "clientsimulation-android_70",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_90",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_X",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_11_12",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_13_14",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-android_15",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chrome_101_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-chromium_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_100_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-firefox_137_win11",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_8_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win7",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 DHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_winphone81",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-ie_11_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_15_win10",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_101_win10_21h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-edge_133_win11_23h2",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_ios_184",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_154_osx_1231",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-safari_184_osx_154",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_7u25",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "No connection"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_80442",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1102",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_1703",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-java_2106",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-go_1178",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-libressl_336",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_CHACHA20_POLY1305_SHA256"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_102e",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_111d",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_315",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-openssl_350",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_256_GCM_SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-apple_mail_16_0",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
},{
|
||||||
|
"id" : "clientsimulation-thunderbird_91_9",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "TLSv1.3 TLS_AES_128_GCM_SHA256"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"rating" : [
|
||||||
|
{
|
||||||
|
"id" : "rating_spec",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)"
|
||||||
|
},{
|
||||||
|
"id" : "rating_doc",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "100"
|
||||||
|
},{
|
||||||
|
"id" : "protocol_support_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "30"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "key_exchange_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "27"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "90"
|
||||||
|
},{
|
||||||
|
"id" : "cipher_strength_score_weighted",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "36"
|
||||||
|
},{
|
||||||
|
"id" : "final_score",
|
||||||
|
"severity" : "INFO",
|
||||||
|
"finding" : "93"
|
||||||
|
},{
|
||||||
|
"id" : "overall_grade",
|
||||||
|
"severity" : "OK",
|
||||||
|
"finding" : "A+"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"scanTime" : 53
|
||||||
|
}
|
||||||
@@ -0,0 +1,208 @@
|
|||||||
|
## Scan started as: "testssl -oA testssl/des08_shelly_repo repo.shelly.cloud:443"
|
||||||
|
## at kali:/usr/bin/openssl
|
||||||
|
## version testssl: 3.2.4 from
|
||||||
|
## version openssl: "3.6.5" from "Tue Sep 29 19:39:32 2026")
|
||||||
|
|
||||||
|
[7m Start 2026-11-04 09:16:54 -->> 35.241.201.25:443 (repo.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
rDNS (35.241.201.25): --
|
||||||
|
Service detected: HTTP
|
||||||
|
|
||||||
|
[1m[4m Testing protocols [m[4mvia sockets except NPN+ALPN [m
|
||||||
|
|
||||||
|
[1m SSLv2 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m SSLv3 [m[1;32mnot offered (OK)[m
|
||||||
|
[1m TLS 1 [mnot offered
|
||||||
|
[1m TLS 1.1 [mnot offered
|
||||||
|
[1m TLS 1.2 [m[1;32moffered (OK)[m
|
||||||
|
[1m TLS 1.3 [m[1;32moffered (OK)[m: final
|
||||||
|
[1m NPN/SPDY [mnot offered
|
||||||
|
[1m ALPN/HTTP2 [mhttp/1.1 (offered)
|
||||||
|
|
||||||
|
[1m[4m Testing cipher categories [m
|
||||||
|
|
||||||
|
[1m NULL ciphers (no encryption) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Anonymous NULL Ciphers (no authentication) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m Export ciphers (w/o ADH+NULL) [m[1;32mnot offered (OK)[m
|
||||||
|
[1m LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) [m[0;32mnot offered (OK)[m
|
||||||
|
[1m Triple DES Ciphers / IDEA [mnot offered
|
||||||
|
[1m Obsoleted CBC ciphers (AES, ARIA etc.) [mnot offered
|
||||||
|
[1m Strong encryption (AEAD ciphers) with no FS [mnot offered
|
||||||
|
[1m Forward Secrecy strong encryption (AEAD ciphers) [m[1;32moffered (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing server's cipher preferences [m
|
||||||
|
|
||||||
|
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
|
||||||
|
-----------------------------------------------------------------------------------------------------------------------------
|
||||||
|
[4mSSLv2[m
|
||||||
|
-
|
||||||
|
[4mSSLv3[m
|
||||||
|
-
|
||||||
|
[4mTLSv1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.1[m
|
||||||
|
-
|
||||||
|
[4mTLSv1.2[m (no server order, thus listed by strength)
|
||||||
|
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
x9f DHE-RSA-AES256-GCM-SHA384 DH[0;32m 2048[m AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH[0;32m 253[m ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xccaa DHE-RSA-CHACHA20-POLY1305 DH[0;32m 2048[m ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||||
|
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
x9e DHE-RSA-AES128-GCM-SHA256 DH[0;32m 2048[m AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
[4mTLSv1.3[m (no server order, thus listed by strength)
|
||||||
|
x1302 TLS_AES_256_GCM_SHA384 ECDH[0;32m 253[m AESGCM 256 TLS_AES_256_GCM_SHA384
|
||||||
|
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH[0;32m 253[m ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
x1301 TLS_AES_128_GCM_SHA256 ECDH[0;32m 253[m AESGCM 128 TLS_AES_128_GCM_SHA256
|
||||||
|
|
||||||
|
[1m Has server cipher order? [mno
|
||||||
|
(limited sense as client will pick)
|
||||||
|
|
||||||
|
[1m[4m Testing robust forward secrecy (FS)[m[4m -- omitting Null Authentication/Encryption, 3DES, RC4 [m
|
||||||
|
|
||||||
|
[0;32m FS is offered (OK) [m TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
|
||||||
|
ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384
|
||||||
|
ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-CHACHA20-POLY1305
|
||||||
|
TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
|
||||||
|
DHE-RSA-AES128-GCM-SHA256
|
||||||
|
[1m KEMs offered [m[1;33mNone[m
|
||||||
|
[1m Elliptic curves offered: [m[0;32mprime256v1[m [0;32msecp384r1[m [0;32mX25519[m
|
||||||
|
[1m DH group offered: [m[0;32mffdhe2048[m
|
||||||
|
[1m TLS 1.2 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
RSA+SHA512 RSA+SHA384 RSA+SHA256 RSA+SHA224
|
||||||
|
[1m TLS 1.3 sig_algs offered: [mRSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256
|
||||||
|
|
||||||
|
[1m[4m Testing server defaults (Server Hello) [m
|
||||||
|
|
||||||
|
[1m TLS extensions (standard) [m"server name/#0" "max fragment length/#1" "status request/#5"
|
||||||
|
"EC point formats/#11" "application layer protocol negotiation/#16"
|
||||||
|
"extended master secret/#23" "supported versions/#43"
|
||||||
|
"key share/#51" "renegotiation info/#65281"
|
||||||
|
[1m Session Ticket RFC 5077 hint [mno -- no lifetime advertised
|
||||||
|
[1m SSL Session ID support [myes
|
||||||
|
[1m Session Resumption [mTickets no, ID: yes
|
||||||
|
[1m TLS clock skew[m Random values, no fingerprinting possible
|
||||||
|
[1m Certificate Compression [mnone
|
||||||
|
[1m Client Authentication [mnone
|
||||||
|
[1m Signature Algorithm [m[0;32mSHA256 with RSA[m
|
||||||
|
[1m Server key size [mRSA 2048 bits (exponent is 65537)
|
||||||
|
[1m Server key usage [mDigital Signature, Key Encipherment
|
||||||
|
[1m Server extended key usage [mTLS Web Server Authentication, TLS Web Client Authentication
|
||||||
|
[1m Serial [m393425BF88EBDD03492962D4E9723D5E (OK: length 16)
|
||||||
|
[1m Fingerprints [mSHA1 CF08E011A413D80E53E6C1C2D27B64B24A5FDCA7
|
||||||
|
SHA256 CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Common Name (CN) [m[3m*.shelly.cloud [m
|
||||||
|
[1m subjectAltName (SAN) [m[3m*.shelly.cloud shelly.cloud [m
|
||||||
|
[1m Trust (hostname) [m[0;32mOk via SAN wildcard and CN wildcard[m (same w/o SNI)
|
||||||
|
[1;33mwildcard certificate[m could be problematic, see other hosts at
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m Chain of trust[m [0;32mOk [m[0;35m[m
|
||||||
|
[1m EV cert[m (experimental) no
|
||||||
|
[1m Certificate Validity (UTC) [m[0;32m63 >= 60 days[m (2025-12-07 00:00 --> 2027-01-06 23:59)
|
||||||
|
[1m ETS/"eTLS"[m, visibility info not present
|
||||||
|
[1m Certificate Revocation List [m--
|
||||||
|
[1m OCSP URI [mhttp://ocsp.sectigo.com
|
||||||
|
[1m OCSP stapling [m[0;32moffered[m, [0;32mnot revoked[m
|
||||||
|
[1m OCSP must staple extension [m--
|
||||||
|
[1m DNS CAA RR[m (experimental) [1;33mnot offered[m
|
||||||
|
[1m Certificate Transparency [m[0;32myes[m (certificate extension)
|
||||||
|
[1m Certificates provided[m 4
|
||||||
|
[1m Issuer [m[3mSectigo Public Server Authentication CA DV R36[m ([3mSectigo Limited[m from [3mGB[m)
|
||||||
|
[1m Intermediate cert validity [m#1: [0;32mok > 40 days[m (2036-03-21 23:59). [3mSectigo Public Server Authentication CA DV R36[m <-- [3mSectigo Public Server Authentication Root R46[m
|
||||||
|
#2: [0;32mok > 40 days[m (2038-01-18 23:59). [3mSectigo Public Server Authentication Root R46[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
#3: [0;32mok > 40 days[m (2038-01-18 23:59). [3mUSERTrust RSA Certification Authority[m <-- [3mUSERTrust RSA Certification Authority[m
|
||||||
|
[1m Intermediate Bad OCSP[m (exp.) [0;32mOk[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing HTTP header response @ "/" [m
|
||||||
|
|
||||||
|
[1m HTTP Status Code [m 401 Unauthorized
|
||||||
|
[1m HTTP clock skew [m0 sec from localtime
|
||||||
|
[1m Strict Transport Security [m[1;33mnot offered[m
|
||||||
|
[1m Public Key Pinning [m--
|
||||||
|
[1m Server banner [mnginx/[33m1(B[m.[33m2(B[m[33m4(B[m.[33m0(B[m ([33m[1mUbuntu(B[m)
|
||||||
|
[1m Application banner [m--
|
||||||
|
[1m Cookie(s) [m(none issued at "/") -- HTTP status 401 signals you maybe missed the web application
|
||||||
|
[1m Security headers [mAccess-Control-Allow-Origin: *
|
||||||
|
[1m Reverse Proxy banner [m--
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Testing vulnerabilities [m
|
||||||
|
|
||||||
|
[1m Heartbleed[m (CVE-2014-0160) [1;32mnot vulnerable (OK)[m, no heartbeat extension
|
||||||
|
[1m CCS[m (CVE-2014-0224) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Ticketbleed[m (CVE-2016-9244), experiment. [1;32mnot vulnerable (OK)[m, no session ticket extension
|
||||||
|
[1m ROBOT [m[1;32mServer does not support any cipher suites that use RSA key transport[m
|
||||||
|
[1m Secure Renegotiation (RFC 5746) [m[1;32msupported (OK)[m
|
||||||
|
[1m Secure Client-Initiated Renegotiation [m[0;32mnot vulnerable (OK)[m
|
||||||
|
[1m CRIME, TLS [m(CVE-2012-4929) [0;32mnot vulnerable (OK)[m
|
||||||
|
[1m BREACH[m (CVE-2013-3587) [0;32mno gzip/deflate/compress/br HTTP compression (OK) [m - only supplied "/" tested
|
||||||
|
[1m POODLE, SSL[m (CVE-2014-3566) [1;32mnot vulnerable (OK)[m, no SSLv3 support
|
||||||
|
[1m TLS_FALLBACK_SCSV[m (RFC 7507) [0;32mNo fallback possible (OK)[m, no protocol below TLS 1.2 offered
|
||||||
|
[1m SWEET32[m (CVE-2016-2183, CVE-2016-6329) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m FREAK[m (CVE-2015-0204) [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m DROWN[m (CVE-2016-0800, CVE-2016-0703) [1;32mnot vulnerable on this host and port (OK)[m
|
||||||
|
make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
|
||||||
|
https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=CB7138667CBB341FAFA36705A26ACA15193824619F51F926ED3C6D362C67D867
|
||||||
|
[1m LOGJAM[m (CVE-2015-4000), experimental common prime with 2048 bits detected: [3mRFC7919/ffdhe2048[m ([0;32m2048 bits[m),
|
||||||
|
but no DH EXPORT ciphers
|
||||||
|
[1m BEAST[m (CVE-2011-3389) [0;32mnot vulnerable (OK)[m, no SSL3 or TLS1
|
||||||
|
[1m LUCKY13[m (CVE-2013-0169), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m Winshock[m (CVE-2014-6321), experimental [1;32mnot vulnerable (OK)[m
|
||||||
|
[1m RC4[m (CVE-2013-2566, CVE-2015-2808) [0;32mno RC4 ciphers detected (OK)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Running client simulations [m[1m[4m(HTTP) [m[1m[4mvia sockets [m
|
||||||
|
|
||||||
|
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
|
||||||
|
------------------------------------------------------------------------------------------------
|
||||||
|
Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 9.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 10.0 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 11/12 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 13/14 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Android 15 (native) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chrome 101 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Chromium 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 100 (Win 10) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Firefox 137 (Win 11) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
IE 8 Win 7 No connection
|
||||||
|
IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||||
|
IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 [0;32m2048 bit DH (ffdhe2048)[m
|
||||||
|
IE 11 Win Phone 8.1 No connection
|
||||||
|
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 101 Win 10 21H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Edge 133 Win 11 23H2 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (iOS 18.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 15.4 (macOS 12.3.1) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Safari 18.4 (macOS 15.4) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 7u25 No connection
|
||||||
|
Java 8u442 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 11.0.2 (OpenJDK) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Java 17.0.3 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Java 21.0.6 (OpenJDK) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
go 1.17.8 TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
LibreSSL 3.3.6 (macOS) TLSv1.3 TLS_CHACHA20_POLY1305_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
OpenSSL 1.1.1d (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.0.15 (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_256_GCM_SHA384 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
Apple Mail (16.0) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [0;32m256 bit ECDH (P-256)[m
|
||||||
|
Thunderbird (91.9) TLSv1.3 TLS_AES_128_GCM_SHA256 [0;32m253 bit ECDH (X25519)[m
|
||||||
|
|
||||||
|
|
||||||
|
[1m[4m Rating (experimental) [m
|
||||||
|
|
||||||
|
[1m Rating specs[m (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009r from 2025-05-16)
|
||||||
|
[1m Specification documentation [mhttps://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
|
||||||
|
[1m Protocol Support [m(weighted) 100 (30)
|
||||||
|
[1m Key Exchange [m (weighted) 90 (27)
|
||||||
|
[1m Cipher Strength [m (weighted) 90 (36)
|
||||||
|
[1m Final Score [m93
|
||||||
|
[1m Overall Grade [m[1;32mA+[m
|
||||||
|
|
||||||
|
[7m Done 2026-11-04 09:17:46 [ 53s] -->> 35.241.201.25:443 (repo.shelly.cloud) <<--[m
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,115 @@
|
|||||||
|
Starting Nmap 7.991 ( https://nmap.org ) at 2026-11-03 09:51 +0100
|
||||||
|
NSE: Loaded 158 scripts for scanning.
|
||||||
|
NSE: Script Pre-scanning.
|
||||||
|
Initiating NSE at 09:51
|
||||||
|
Completed NSE at 09:51, 0.00s elapsed
|
||||||
|
Initiating NSE at 09:51
|
||||||
|
Completed NSE at 09:51, 0.00s elapsed
|
||||||
|
Initiating NSE at 09:51
|
||||||
|
Completed NSE at 09:51, 0.00s elapsed
|
||||||
|
Initiating Ping Scan at 09:51
|
||||||
|
Scanning 10.12.2.30 [4 ports]
|
||||||
|
Completed Ping Scan at 09:51, 0.02s elapsed (1 total hosts)
|
||||||
|
Initiating Parallel DNS resolution of 1 host. at 09:51
|
||||||
|
Completed Parallel DNS resolution of 1 host. at 09:51, 0.50s elapsed
|
||||||
|
Initiating SYN Stealth Scan at 09:51
|
||||||
|
Scanning 10.12.2.30 [65535 ports]
|
||||||
|
Discovered open port 80/tcp on 10.12.2.30
|
||||||
|
SYN Stealth Scan Timing: About 32.16% done; ETC: 09:52 (0:01:05 remaining)
|
||||||
|
SYN Stealth Scan Timing: About 57.81% done; ETC: 09:52 (0:00:49 remaining)
|
||||||
|
Completed SYN Stealth Scan at 09:52, 87.79s elapsed (65535 total ports)
|
||||||
|
Initiating Service scan at 09:52
|
||||||
|
Scanning 1 service on 10.12.2.30
|
||||||
|
Completed Service scan at 09:52, 12.27s elapsed (1 service on 1 host)
|
||||||
|
Initiating OS detection (try #1) against 10.12.2.30
|
||||||
|
Retrying OS detection (try #2) against 10.12.2.30
|
||||||
|
Initiating Traceroute at 09:52
|
||||||
|
Completed Traceroute at 09:52, 0.02s elapsed
|
||||||
|
Initiating Parallel DNS resolution of 2 hosts. at 09:52
|
||||||
|
Completed Parallel DNS resolution of 2 hosts. at 09:52, 0.50s elapsed
|
||||||
|
NSE: Script scanning 10.12.2.30.
|
||||||
|
Initiating NSE at 09:52
|
||||||
|
Completed NSE at 09:52, 5.03s elapsed
|
||||||
|
Initiating NSE at 09:52
|
||||||
|
Completed NSE at 09:52, 1.14s elapsed
|
||||||
|
Initiating NSE at 09:52
|
||||||
|
Completed NSE at 09:52, 0.00s elapsed
|
||||||
|
Nmap scan report for 10.12.2.30
|
||||||
|
Host is up (0.0047s latency).
|
||||||
|
Not shown: 65534 filtered tcp ports (no-response)
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
80/tcp open http
|
||||||
|
|_http-title: Site doesn't have a title (text/html).
|
||||||
|
| http-methods:
|
||||||
|
|_ Supported Methods: GET HEAD POST OPTIONS
|
||||||
|
| fingerprint-strings:
|
||||||
|
| DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, RTSPRequest, SSLSessionReq, TerminalServerCookie, X11Probe:
|
||||||
|
| HTTP/1.1 400 Bad Request
|
||||||
|
| Content-Type: text/html
|
||||||
|
| Content-Length: 57
|
||||||
|
| Server unable to understand request due to invalid syntax
|
||||||
|
| FourOhFourRequest:
|
||||||
|
| HTTP/1.1 404 Not Found
|
||||||
|
| Content-Type: text/html
|
||||||
|
| Content-Length: 56
|
||||||
|
| Resource /nice%20ports%2C/Tri%6Eity.txt%2ebak not found!
|
||||||
|
| GetRequest, HTTPOptions:
|
||||||
|
| HTTP/1.1 404 Not Found
|
||||||
|
| Content-Type: text/html
|
||||||
|
| Content-Length: 21
|
||||||
|
|_ Resource / not found!
|
||||||
|
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
|
||||||
|
SF-Port80-TCP:V=7.991%I=7%D=11/3%Time=6AE9A0D2%P=x86_64-pc-linux-gnu%r(Get
|
||||||
|
SF:Request,5C,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20text/h
|
||||||
|
SF:tml\r\nContent-Length:\x2021\r\n\r\nResource\x20/\x20not\x20found!")%r(
|
||||||
|
SF:HTTPOptions,5C,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20te
|
||||||
|
SF:xt/html\r\nContent-Length:\x2021\r\n\r\nResource\x20/\x20not\x20found!"
|
||||||
|
SF:)%r(RTSPRequest,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:
|
||||||
|
SF:\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20unable\x20to\x2
|
||||||
|
SF:0understand\x20request\x20due\x20to\x20invalid\x20syntax")%r(X11Probe,8
|
||||||
|
SF:2,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/html\r\n
|
||||||
|
SF:Content-Length:\x2057\r\n\r\nServer\x20unable\x20to\x20understand\x20re
|
||||||
|
SF:quest\x20due\x20to\x20invalid\x20syntax")%r(FourOhFourRequest,7F,"HTTP/
|
||||||
|
SF:1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20text/html\r\nContent-Le
|
||||||
|
SF:ngth:\x2056\r\n\r\nResource\x20/nice%20ports%2C/Tri%6Eity\.txt%2ebak\x2
|
||||||
|
SF:0not\x20found!")%r(RPCCheck,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nC
|
||||||
|
SF:ontent-Type:\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20una
|
||||||
|
SF:ble\x20to\x20understand\x20request\x20due\x20to\x20invalid\x20syntax")%
|
||||||
|
SF:r(DNSVersionBindReqTCP,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConten
|
||||||
|
SF:t-Type:\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20unable\x
|
||||||
|
SF:20to\x20understand\x20request\x20due\x20to\x20invalid\x20syntax")%r(DNS
|
||||||
|
SF:StatusRequestTCP,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type
|
||||||
|
SF::\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20unable\x20to\x
|
||||||
|
SF:20understand\x20request\x20due\x20to\x20invalid\x20syntax")%r(Help,82,"
|
||||||
|
SF:HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/html\r\nCon
|
||||||
|
SF:tent-Length:\x2057\r\n\r\nServer\x20unable\x20to\x20understand\x20reque
|
||||||
|
SF:st\x20due\x20to\x20invalid\x20syntax")%r(SSLSessionReq,82,"HTTP/1\.1\x2
|
||||||
|
SF:0400\x20Bad\x20Request\r\nContent-Type:\x20text/html\r\nContent-Length:
|
||||||
|
SF:\x2057\r\n\r\nServer\x20unable\x20to\x20understand\x20request\x20due\x2
|
||||||
|
SF:0to\x20invalid\x20syntax")%r(TerminalServerCookie,82,"HTTP/1\.1\x20400\
|
||||||
|
SF:x20Bad\x20Request\r\nContent-Type:\x20text/html\r\nContent-Length:\x205
|
||||||
|
SF:7\r\n\r\nServer\x20unable\x20to\x20understand\x20request\x20due\x20to\x
|
||||||
|
SF:20invalid\x20syntax");
|
||||||
|
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
|
||||||
|
Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (90%), DD-WRT v24-sp2 (Linux 2.4.37) (90%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (90%), Linux 3.2 (88%), Microsoft Windows XP SP3 (88%), VMware Player virtual NAT device (88%), Linux 4.4 (87%)
|
||||||
|
No exact OS matches for host (test conditions non-ideal).
|
||||||
|
Network Distance: 2 hops
|
||||||
|
TCP Sequence Prediction: Difficulty=255 (Good luck!)
|
||||||
|
IP ID Sequence Generation: Randomized
|
||||||
|
|
||||||
|
TRACEROUTE (using port 80/tcp)
|
||||||
|
HOP RTT ADDRESS
|
||||||
|
1 0.38 ms 192.168.212.2
|
||||||
|
2 0.44 ms 10.12.2.30
|
||||||
|
|
||||||
|
NSE: Script Post-scanning.
|
||||||
|
Initiating NSE at 09:52
|
||||||
|
Completed NSE at 09:52, 0.00s elapsed
|
||||||
|
Initiating NSE at 09:52
|
||||||
|
Completed NSE at 09:52, 0.00s elapsed
|
||||||
|
Initiating NSE at 09:52
|
||||||
|
Completed NSE at 09:52, 0.00s elapsed
|
||||||
|
Read data files from: /usr/share/nmap
|
||||||
|
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||||
|
Nmap done: 1 IP address (1 host up) scanned in 111.22 seconds
|
||||||
|
Raw packets sent: 131214 (5.777MB) | Rcvd: 15482 (620.606KB)
|
||||||
Reference in New Issue
Block a user