Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Testing protocols (via sockets except TLS 1.2, SPDY+HTTP2)
- SSLv2 not offered (OK)
- SSLv3 not offered (OK)
- TLS 1 offered
- TLS 1.1 offered
- TLS 1.2 offered (OK)
- SPDY/NPN http/1.1 (advertised)
- HTTP2/ALPN not offered
- Testing ~standard cipher lists
- Null Ciphers not offered (OK)
- Anonymous NULL Ciphers not offered (OK)
- Anonymous DH Ciphers not offered (OK)
- 40 Bit encryption not offered (OK)
- 56 Bit encryption not offered (OK)
- Export Ciphers (general) not offered (OK)
- Low (<=64 Bit) not offered (OK)
- DES Ciphers not offered (OK)
- Medium grade encryption not offered (OK)
- Triple DES Ciphers offered (NOT ok)
- High grade encryption offered (OK)
- Testing (perfect) forward secrecy, (P)FS -- omitting 3DES, RC4 and Null Encryption here
- PFS is offered (OK) ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA
- Testing server preferences
- Has server cipher order? yes (OK)
- Negotiated protocol TLSv1.2
- Negotiated cipher ECDHE-RSA-AES256-GCM-SHA384, 256 bit ECDH
- Cipher order
- TLSv1: ECDHE-RSA-AES256-SHA DHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-AES128-SHA ECDHE-RSA-DES-CBC3-SHA EDH-RSA-DES-CBC3-SHA AES256-SHA AES128-SHA DES-CBC3-SHA
- TLSv1.1: ECDHE-RSA-AES256-SHA DHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-AES128-SHA ECDHE-RSA-DES-CBC3-SHA EDH-RSA-DES-CBC3-SHA AES256-SHA AES128-SHA DES-CBC3-SHA
- TLSv1.2: ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA DHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA ECDHE-RSA-DES-CBC3-SHA EDH-RSA-DES-CBC3-SHA AES256-GCM-SHA384 AES128-GCM-SHA256 AES256-SHA256 AES256-SHA AES128-SHA256 AES128-SHA DES-CBC3-SHA
- http/1.1: ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA EDH-RSA-DES-CBC3-SHA AES256-GCM-SHA384 AES128-GCM-SHA256 AES256-SHA256 AES256-SHA AES128-SHA256 AES128-SHA DES-CBC3-SHA
- Testing server defaults (Server Hello)
- TLS extensions (standard) "server name/#0" "renegotiation info/#65281" "EC point formats/#11" "session ticket/#35" "heartbeat/#15" "next protocol/#13172"
- Session Tickets RFC 5077 300 seconds (PFS requires session ticket keys to be rotated <= daily)
- SSL Session ID support yes
- TLS clock skew random values, no fingerprinting possible
- Signature Algorithm SHA256 with RSA
- Server key size weird keysize: 8192 bits (could cause compatibility problems)
- Fingerprint / Serial SHA1 DB34E0552C738ACE2827AEF7EABE1268C7A5C58C / 069CCA3DDC2EE9
- SHA256 CE5B5CA8481460673703FB5188A1055A5B8B73617221CB057F8BD30D6811713F
- Common Name (CN) "blogg.grin.hu" (CN in response to request w/o SNI: "rbl.foobar.hu")
- subjectAltName (SAN) "blogg.grin.hu" "grin.hu"
- Issuer "StartCom Class 1 Primary Intermediate Server CA" ("StartCom Ltd." from "IL")
- EV cert (experimental) no
- Certificate Expiration 239 >= 60 days (2015-11-16 14:32 --> 2016-11-16 13:28 +0100)
- # of certificates provided 3
- Chain of trust (experim.) Ok
- Certificate Revocation List http://crl.startssl.com/crt1-crl.crl
- OCSP URI http://ocsp.startssl.com/sub/class1/server/ca
- OCSP stapling --
- Testing HTTP header response @ "/"
- HTTP Status Code 200 OK
- HTTP clock skew +7 sec from localtime
- Strict Transport Security 730 days=63072000 s, includeSubDomains, preload
- Public Key Pinning --
- Server banner nginx/1.6.2
- Application banner --
- Cookie(s) (none issued at "/")
- Security headers X-Frame-Options: SAMEORIGIN
- X-Content-Type-Options: nosniff
- Reverse Proxy banner --
- Testing vulnerabilities
- Heartbleed (CVE-2014-0160) not vulnerable (OK) (timed out)
- CCS (CVE-2014-0224) not vulnerable (OK)
- Secure Renegotiation (CVE-2009-3555) not vulnerable (OK)
- Secure Client-Initiated Renegotiation not vulnerable (OK)
- CRIME, TLS (CVE-2012-4929) not vulnerable (OK)
- BREACH (CVE-2013-3587) potentially NOT ok, uses gzip HTTP compression. - only supplied "/" tested
- Can be ignored for static pages or if no secrets in the page
- POODLE, SSL (CVE-2014-3566) not vulnerable (OK)
- TLS_FALLBACK_SCSV (RFC 7507), experim. Downgrade attack prevention supported (OK)
- FREAK (CVE-2015-0204) not vulnerable (OK)
- LOGJAM (CVE-2015-4000), experimental not vulnerable (OK), common primes not checked. See below for any DH ciphers + bit size
- BEAST (CVE-2011-3389) TLS1: DES-CBC3-SHA EDH-RSA-DES-CBC3-SHA
- AES128-SHA DHE-RSA-AES128-SHA AES256-SHA
- DHE-RSA-AES256-SHA ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-AES128-SHA
- ECDHE-RSA-AES256-SHA
- VULNERABLE -- but also supports higher protocols (possible mitigation): TLSv1.1 TLSv1.2
- RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK)
- Testing all 181 locally available ciphers against the server, ordered by encryption strength
- Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (RFC)
- --------------------------------------------------------------------------------------------------------------------------
- xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- xc028 ECDHE-RSA-AES256-SHA384 ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
- xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- x9f DHE-RSA-AES256-GCM-SHA384 DH 4096 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
- x6b DHE-RSA-AES256-SHA256 DH 4096 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
- x39 DHE-RSA-AES256-SHA DH 4096 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
- x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
- x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
- x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
- xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- xc027 ECDHE-RSA-AES128-SHA256 ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- x9e DHE-RSA-AES128-GCM-SHA256 DH 4096 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
- x67 DHE-RSA-AES128-SHA256 DH 4096 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
- x33 DHE-RSA-AES128-SHA DH 4096 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
- x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
- x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
- x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
- xc012 ECDHE-RSA-DES-CBC3-SHA ECDH 256 3DES 168 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
- x16 EDH-RSA-DES-CBC3-SHA DH 4096 3DES 168 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
- x0a DES-CBC3-SHA RSA 3DES 168 TLS_RSA_WITH_3DES_EDE_CBC_SHA
- Running browser simulations (experimental)
- Android 2.3.7 TLSv1 DHE-RSA-AES128-SHA
- Android 4.0.4 TLSv1 DHE-RSA-AES256-SHA
- Android 4.1.1 TLSv1 ECDHE-RSA-AES256-SHA
- Android 4.2.2 TLSv1 ECDHE-RSA-AES256-SHA
- Android 4.3 TLSv1.0 ECDHE-RSA-AES256-SHA
- Android 4.4.2 TLSv1.1 ECDHE-RSA-AES256-SHA
- Android 5.0.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
- Baidu Jan 2015 TLSv1 ECDHE-RSA-AES256-SHA
- BingPreview Jan 2015 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- Chrome 47 / OSX TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
- Firefox 31.3.0ESR / Win7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
- Firefox 42 / OSX TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
- GoogleBot Feb 2015 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
- IE6 / XP No connection << good riddance :-P
- IE7 / Vista TLSv1.0 ECDHE-RSA-AES256-SHA
- IE8 / XP TLSv1.0 DES-CBC3-SHA
- IE8-10 / Win7 TLSv1.0 ECDHE-RSA-AES256-SHA
- IE11 / Win7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384
- IE11 / Win8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384
- IE10 / Win Phone 8.0 TLSv1.0 ECDHE-RSA-AES256-SHA
- IE11 / Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES256-SHA
- IE11 / Win Phone 8.1 Update TLSv1.2 DHE-RSA-AES256-GCM-SHA384
- IE11 / Win10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- Edge 13 / Win10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- Edge 12 / Win Phone 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- Java 6u45 TLSv1 DHE-RSA-AES128-SHA
- Java 7u25 TLSv1 ECDHE-RSA-AES128-SHA
- Java 8u31 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
- OpenSSL 0.9.8y TLSv1 DHE-RSA-AES256-SHA
- OpenSSL 1.0.1l TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- OpenSSL 1.0.2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- Safari 5.1.9/ OSX 10.6.8 TLSv1 ECDHE-RSA-AES256-SHA
- Safari 6 / iOS 6.0.1 TLSv1.2 ECDHE-RSA-AES256-SHA384
- Safari 6.0.4/ OS X 10.8.4 TLSv1 ECDHE-RSA-AES256-SHA
- Safari 7 / iOS 7.1 TLSv1.2 ECDHE-RSA-AES256-SHA384
- Safari 7 / OS X 10.9 TLSv1.2 ECDHE-RSA-AES256-SHA384
- Safari 8 / iOS 8.4 TLSv1.2 ECDHE-RSA-AES256-SHA384
- Safari 8 / OS X 10.10 TLSv1.2 ECDHE-RSA-AES256-SHA384
- Safari 9 / iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
- Safari 9 / OS X 10.11 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
Advertisement
Add Comment
Please, Sign In to add comment
