pass
TLS·11
netray.info · tls
# netray.info · tls
## Checks
| Code | Check | Status | Finding | Fix |
|---|---|---|---|---|
| TLS·11 | TLS reachable | pass | | |
| TLS·12 | Chain trusted | pass | | |
| TLS·13 | Certificate valid | pass | | |
| TLS·14 | Hostname match | pass | | |
| TLS·15 | Chain complete | pass | | |
| TLS·16 | Strong signature | pass | | |
| TLS·17 | Key strength | pass | | |
| TLS·18 | Expiry window | warn | 130.162.45.139: leaf certificate expires in 30 days | Renew the certificate now and automate future renewals. |
| TLS·19 | Certificate lifetime | pass | | |
| TLS·20 | SAN quality | pass | | |
| TLS·21 | AIA reachable | not\_applicable | Chain is complete; AIA URLs not required for verification | |
| TLS·22 | TLS version | pass | | |
| TLS·23 | Forward secrecy | pass | | |
| TLS·24 | AEAD cipher | pass | | |
| TLS·25 | Legacy protocol versions | pass | | |
| TLS·26 | Weak cipher suites | pass | | |
| TLS·27 | OCSP stapling | not\_applicable | CA does not provide OCSP (CRL only) | |
| TLS·28 | CT logged | pass | | |
| TLS·29 | CAA compliant | pass | | |
| TLS·30 | DANE valid | not\_applicable | DANE check skipped (requires DNSSEC) | |
| TLS·31 | Multi-IP consistency | not\_applicable | fewer than 2 IPs inspected | |
| TLS·32 | ALPN consistency | not\_applicable | fewer than 2 IPs inspected | |
| TLS·33 | ECH advertised | warn | 130.162.45.139: ECH not advertised in HTTPS DNS record | Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server. |
## Addresses
| address | port | outcome | message |
|---|---|---|---|
| 130.162.45.139 | 443 | ok | |
| 2603:c020:8023:6d00:0:c658:5b78:6699 | 443 | NOT\_TESTED\_FROM\_HERE | Network unreachable (os error 101) |
## Certificate chain 130.162.45.139:443
- position: leaf, subject: CN=netray.info, issuer: C=US, O=Let's Encrypt, CN=YR2, sans: netray.info, not\_before: 2026-09-07T21:47:50Z, not\_after: 2026-12-06T21:47:49Z, days\_remaining: 30, key: RSA 4096, signature\_algorithm: sha256WithRSAEncryption, fingerprint\_sha256: 01:85:DC:66:B0:87:75:B9:57:8A:6F:8A:6B:F9:42:40:69:38:BA:82:12:C6:8A:84:39:29:EE:90:85:90:BD:76, fingerprint\_sha1: 6C:BB:59:A5:4D:EA:27:01:32:CA:FB:3B:84:36:7C:0F:AF:02:CB:88, serial: 05:A4:2F:BC:F3:FE:DD:E3:32:EE:77:E9:91:67:6B:41:61:E6, policy: DV, self\_signed: false, expired: false, ca\_issuers\_url: http://yr2.i.lencr.org/
- position: intermediate, subject: C=US, O=Let's Encrypt, CN=YR2, issuer: C=US, O=ISRG, CN=Root YR, not\_before: 2025-09-03T00:00:00Z, not\_after: 2028-09-02T23:59:59Z, days\_remaining: 666, key: RSA 2048, signature\_algorithm: sha256WithRSAEncryption, fingerprint\_sha256: 23:8B:85:A0:09:9C:65:B9:70:47:7D:57:24:F1:A1:D4:75:CE:50:58:CF:FE:4E:FA:87:33:89:9B:DB:86:3C:47, fingerprint\_sha1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37, serial: 4E:BD:24:94:7E:24:D3:94:80:2D:84:A5:2F:D5:B3:19, policy: OV, self\_signed: false, expired: false, ca\_issuers\_url: http://yr.i.lencr.org/
- position: intermediate, subject: C=US, O=ISRG, CN=Root YR, issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1, not\_before: 2026-05-13T00:00:00Z, not\_after: 2032-09-02T23:59:59Z, days\_remaining: 2127, key: RSA 4096, signature\_algorithm: sha256WithRSAEncryption, fingerprint\_sha256: 07:26:39:D0:B1:40:D5:BF:FA:E1:6A:D9:C3:F6:CC:60:86:04:06:21:F5:1E:E6:1A:6D:46:A8:91:5C:07:CF:76, fingerprint\_sha1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98, serial: 00:F2:4B:6D:17:F9:D9:AD:7C:B1:C9:FE:A7:87:82:69:9F, policy: OV, self\_signed: false, expired: false, ca\_issuers\_url: http://x1.i.lencr.org/
## Handshake 130.162.45.139:443
| Field | Value |
|---|---|
| version | TLSv1.3 |
| cipher\_suite | TLS13\_AES\_128\_GCM\_SHA256 |
| key\_exchange\_group | X25519 |
| sni | netray.info |
| ocsp\_stapled | false |
| ech | false |
| handshake\_ms | 127 ms |
## Protocol probes 130.162.45.139:443
| Field | Value |
|---|---|
| ssl3 | disabled |
| ssl3\_answer | alert protocol\_version |
| tls1\_0 | disabled |
| tls1\_0\_answer | alert protocol\_version |
| tls1\_1 | disabled |
| tls1\_1\_answer | alert protocol\_version |
| tls1\_2 | enabled |
| tls1\_2\_answer | server\_hello TLSv1.2 TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 |
| tls1\_3 | enabled |
| tls1\_3\_answer | handshake TLSv1.3 |
| suites\_insecure | refused |
| suites\_insecure\_answer | alert handshake\_failure |
| suites\_cbc | refused |
| suites\_cbc\_answer | alert handshake\_failure |
| suites\_static\_rsa | refused |
| suites\_static\_rsa\_answer | alert handshake\_failure |
## Protocols and features
| Field | Value |
|---|---|
| ssl3 | disabled |
| tls1\_0 | disabled |
| tls1\_1 | disabled |
| tls1\_2 | enabled |
| tls1\_3 | enabled |
| suites\_insecure | refused |
| suites\_cbc | refused |
| suites\_static\_rsa | refused |
| forward\_secrecy\_all\_suites | true |
## Certificate Transparency
| address | sct\_count | log\_ids |
|---|---|---|
| 130.162.45.139 | 2 | d809553b944f7affc816196f944f85abb0f8fc5e8755260f15d12e72bb454b14, 6cfe501943a85ea916bc52d133e4dcc91ef1411c7d258420d173809e1818eb3a |
section,item,field,value
checks,tls.tls_reachable,status,pass
checks,tls.tls_reachable,finding,
checks,tls.tls_reachable,fix,
checks,tls.chain_trusted,status,pass
checks,tls.chain_trusted,finding,
checks,tls.chain_trusted,fix,
checks,tls.not_expired,status,pass
checks,tls.not_expired,finding,
checks,tls.not_expired,fix,
checks,tls.hostname_match,status,pass
checks,tls.hostname_match,finding,
checks,tls.hostname_match,fix,
checks,tls.chain_complete,status,pass
checks,tls.chain_complete,finding,
checks,tls.chain_complete,fix,
checks,tls.strong_signature,status,pass
checks,tls.strong_signature,finding,
checks,tls.strong_signature,fix,
checks,tls.key_strength,status,pass
checks,tls.key_strength,finding,
checks,tls.key_strength,fix,
checks,tls.expiry_window,status,warn
checks,tls.expiry_window,finding,130.162.45.139: leaf certificate expires in 30 days
checks,tls.expiry_window,fix,Renew the certificate now and automate future renewals.
checks,tls.cert_lifetime,status,pass
checks,tls.cert_lifetime,finding,
checks,tls.cert_lifetime,fix,
checks,tls.san_quality,status,pass
checks,tls.san_quality,finding,
checks,tls.san_quality,fix,
checks,tls.aia_reachability,status,not_applicable
checks,tls.aia_reachability,finding,Chain is complete; AIA URLs not required for verification
checks,tls.aia_reachability,fix,
checks,tls.tls_version,status,pass
checks,tls.tls_version,finding,
checks,tls.tls_version,fix,
checks,tls.forward_secrecy,status,pass
checks,tls.forward_secrecy,finding,
checks,tls.forward_secrecy,fix,
checks,tls.aead_cipher,status,pass
checks,tls.aead_cipher,finding,
checks,tls.aead_cipher,fix,
checks,tls.legacy_versions,status,pass
checks,tls.legacy_versions,finding,
checks,tls.legacy_versions,fix,
checks,tls.weak_suites,status,pass
checks,tls.weak_suites,finding,
checks,tls.weak_suites,fix,
checks,tls.ocsp_stapled,status,not_applicable
checks,tls.ocsp_stapled,finding,CA does not provide OCSP (CRL only)
checks,tls.ocsp_stapled,fix,
checks,tls.ct_logged,status,pass
checks,tls.ct_logged,finding,
checks,tls.ct_logged,fix,
checks,tls.caa_compliant,status,pass
checks,tls.caa_compliant,finding,
checks,tls.caa_compliant,fix,
checks,tls.dane_valid,status,not_applicable
checks,tls.dane_valid,finding,DANE check skipped (requires DNSSEC)
checks,tls.dane_valid,fix,
checks,tls.consistency,status,not_applicable
checks,tls.consistency,finding,fewer than 2 IPs inspected
checks,tls.consistency,fix,
checks,tls.alpn_consistency,status,not_applicable
checks,tls.alpn_consistency,finding,fewer than 2 IPs inspected
checks,tls.alpn_consistency,fix,
checks,tls.ech_advertised,status,warn
checks,tls.ech_advertised,finding,130.162.45.139: ECH not advertised in HTTPS DNS record
checks,tls.ech_advertised,fix,"Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server."
tls.addresses,130.162.45.139,address,130.162.45.139
tls.addresses,130.162.45.139,port,443
tls.addresses,130.162.45.139,outcome,ok
tls.addresses,130.162.45.139,message,
tls.addresses,2603:c020:8023:6d00:0:c658:5b78:6699,address,2603:c020:8023:6d00:0:c658:5b78:6699
tls.addresses,2603:c020:8023:6d00:0:c658:5b78:6699,port,443
tls.addresses,2603:c020:8023:6d00:0:c658:5b78:6699,outcome,NOT_TESTED_FROM_HERE
tls.addresses,2603:c020:8023:6d00:0:c658:5b78:6699,message,Network unreachable (os error 101)
tls.chain@130.162.45.139:443,0,position,leaf
tls.chain@130.162.45.139:443,0,subject,CN=netray.info
tls.chain@130.162.45.139:443,0,issuer,"C=US, O=Let's Encrypt, CN=YR2"
tls.chain@130.162.45.139:443,0,sans,netray.info
tls.chain@130.162.45.139:443,0,not_before,2026-09-07T21:47:50Z
tls.chain@130.162.45.139:443,0,not_after,2026-12-06T21:47:49Z
tls.chain@130.162.45.139:443,0,days_remaining,30
tls.chain@130.162.45.139:443,0,key,RSA 4096
tls.chain@130.162.45.139:443,0,signature_algorithm,sha256WithRSAEncryption
tls.chain@130.162.45.139:443,0,fingerprint_sha256,01:85:DC:66:B0:87:75:B9:57:8A:6F:8A:6B:F9:42:40:69:38:BA:82:12:C6:8A:84:39:29:EE:90:85:90:BD:76
tls.chain@130.162.45.139:443,0,fingerprint_sha1,6C:BB:59:A5:4D:EA:27:01:32:CA:FB:3B:84:36:7C:0F:AF:02:CB:88
tls.chain@130.162.45.139:443,0,serial,05:A4:2F:BC:F3:FE:DD:E3:32:EE:77:E9:91:67:6B:41:61:E6
tls.chain@130.162.45.139:443,0,policy,DV
tls.chain@130.162.45.139:443,0,self_signed,false
tls.chain@130.162.45.139:443,0,expired,false
tls.chain@130.162.45.139:443,0,ca_issuers_url,http://yr2.i.lencr.org/
tls.chain@130.162.45.139:443,1,position,intermediate
tls.chain@130.162.45.139:443,1,subject,"C=US, O=Let's Encrypt, CN=YR2"
tls.chain@130.162.45.139:443,1,issuer,"C=US, O=ISRG, CN=Root YR"
tls.chain@130.162.45.139:443,1,not_before,2025-09-03T00:00:00Z
tls.chain@130.162.45.139:443,1,not_after,2028-09-02T23:59:59Z
tls.chain@130.162.45.139:443,1,days_remaining,666
tls.chain@130.162.45.139:443,1,key,RSA 2048
tls.chain@130.162.45.139:443,1,signature_algorithm,sha256WithRSAEncryption
tls.chain@130.162.45.139:443,1,fingerprint_sha256,23:8B:85:A0:09:9C:65:B9:70:47:7D:57:24:F1:A1:D4:75:CE:50:58:CF:FE:4E:FA:87:33:89:9B:DB:86:3C:47
tls.chain@130.162.45.139:443,1,fingerprint_sha1,2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37
tls.chain@130.162.45.139:443,1,serial,4E:BD:24:94:7E:24:D3:94:80:2D:84:A5:2F:D5:B3:19
tls.chain@130.162.45.139:443,1,policy,OV
tls.chain@130.162.45.139:443,1,self_signed,false
tls.chain@130.162.45.139:443,1,expired,false
tls.chain@130.162.45.139:443,1,ca_issuers_url,http://yr.i.lencr.org/
tls.chain@130.162.45.139:443,2,position,intermediate
tls.chain@130.162.45.139:443,2,subject,"C=US, O=ISRG, CN=Root YR"
tls.chain@130.162.45.139:443,2,issuer,"C=US, O=Internet Security Research Group, CN=ISRG Root X1"
tls.chain@130.162.45.139:443,2,not_before,2026-05-13T00:00:00Z
tls.chain@130.162.45.139:443,2,not_after,2032-09-02T23:59:59Z
tls.chain@130.162.45.139:443,2,days_remaining,2127
tls.chain@130.162.45.139:443,2,key,RSA 4096
tls.chain@130.162.45.139:443,2,signature_algorithm,sha256WithRSAEncryption
tls.chain@130.162.45.139:443,2,fingerprint_sha256,07:26:39:D0:B1:40:D5:BF:FA:E1:6A:D9:C3:F6:CC:60:86:04:06:21:F5:1E:E6:1A:6D:46:A8:91:5C:07:CF:76
tls.chain@130.162.45.139:443,2,fingerprint_sha1,AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98
tls.chain@130.162.45.139:443,2,serial,00:F2:4B:6D:17:F9:D9:AD:7C:B1:C9:FE:A7:87:82:69:9F
tls.chain@130.162.45.139:443,2,policy,OV
tls.chain@130.162.45.139:443,2,self_signed,false
tls.chain@130.162.45.139:443,2,expired,false
tls.chain@130.162.45.139:443,2,ca_issuers_url,http://x1.i.lencr.org/
tls.handshake@130.162.45.139:443,,version,TLSv1.3
tls.handshake@130.162.45.139:443,,cipher_suite,TLS13_AES_128_GCM_SHA256
tls.handshake@130.162.45.139:443,,key_exchange_group,X25519
tls.handshake@130.162.45.139:443,,sni,netray.info
tls.handshake@130.162.45.139:443,,ocsp_stapled,false
tls.handshake@130.162.45.139:443,,ech,false
tls.handshake@130.162.45.139:443,,handshake_ms,127 ms
tls.probes@130.162.45.139:443,,ssl3,disabled
tls.probes@130.162.45.139:443,,ssl3_answer,alert protocol_version
tls.probes@130.162.45.139:443,,tls1_0,disabled
tls.probes@130.162.45.139:443,,tls1_0_answer,alert protocol_version
tls.probes@130.162.45.139:443,,tls1_1,disabled
tls.probes@130.162.45.139:443,,tls1_1_answer,alert protocol_version
tls.probes@130.162.45.139:443,,tls1_2,enabled
tls.probes@130.162.45.139:443,,tls1_2_answer,server_hello TLSv1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
tls.probes@130.162.45.139:443,,tls1_3,enabled
tls.probes@130.162.45.139:443,,tls1_3_answer,handshake TLSv1.3
tls.probes@130.162.45.139:443,,suites_insecure,refused
tls.probes@130.162.45.139:443,,suites_insecure_answer,alert handshake_failure
tls.probes@130.162.45.139:443,,suites_cbc,refused
tls.probes@130.162.45.139:443,,suites_cbc_answer,alert handshake_failure
tls.probes@130.162.45.139:443,,suites_static_rsa,refused
tls.probes@130.162.45.139:443,,suites_static_rsa_answer,alert handshake_failure
tls.protocols,,ssl3,disabled
tls.protocols,,tls1_0,disabled
tls.protocols,,tls1_1,disabled
tls.protocols,,tls1_2,enabled
tls.protocols,,tls1_3,enabled
tls.protocols,,suites_insecure,refused
tls.protocols,,suites_cbc,refused
tls.protocols,,suites_static_rsa,refused
tls.protocols,,forward_secrecy_all_suites,true
tls.ct,130.162.45.139,address,130.162.45.139
tls.ct,130.162.45.139,sct_count,2
tls.ct,130.162.45.139,log_ids,"d809553b944f7affc816196f944f85abb0f8fc5e8755260f15d12e72bb454b14, 6cfe501943a85ea916bc52d133e4dcc91ef1411c7d258420d173809e1818eb3a"
{"id":"WjP1e44d","domain":"netray.info","created_at":1793928800,"last_seen_at":1793994166,"predecessor_id":"DlNwSiJd","profile_version":5,"grade":"A","engine_version":"0.31.0","run":{"profile_version":5,"engine_version":"0.31.0","evidence_schema_version":1,"grade":"A","complete":true,"sections":[{"protocol":"dns","outcome":"measured","reason":null},{"protocol":"email","outcome":"measured","reason":null},{"protocol":"http","outcome":"measured","reason":null},{"protocol":"ip","outcome":"measured","reason":null},{"protocol":"tls","outcome":"measured","reason":null}],"checks":[{"id":"dns.caa","status":"pass","evidence":["dns.caa"]},{"id":"dns.cname_apex","status":"pass","evidence":["dns.cname","dns.soa"]},{"id":"dns.dnssec","status":"pass","evidence":["dns.dnskey","dns.ds","dns.nsec","dns.nsec3"]},{"id":"dns.dnskey_algorithm","status":"pass","evidence":["dns.dnskey"]},{"id":"dns.dnssec_rollover","status":"pass","evidence":["dns.dnskey","dns.ds"]},{"id":"dns.https_svcb","status":"pass","evidence":["dns.https","dns.svcb"]},{"id":"dns.ns","status":"pass","evidence":["dns.ns"]},{"id":"dns.ns_lame","status":"pass","evidence":["dns.ns"]},{"id":"dns.ns_delegation","status":"pass","evidence":["dns.ns"]},{"id":"dns.ttl","status":"pass","evidence":["dns.a","dns.aaaa","dns.mx","dns.caa","dns.ns","dns.https","dns.cname","dns.dnskey","dns.ds","dns.nsec","dns.nsec3","dns.soa","dns.svcb","dns.txt"]},{"id":"email.mx","status":"pass","findings":["only one MX record, but it resolves to 4 IP addresses"],"evidence":["email.mx","email.mx_addresses"]},{"id":"email.spf","status":"pass","evidence":["email.spf","email.mx_addresses"]},{"id":"email.dkim","status":"pass","evidence":["email.dkim"]},{"id":"email.dmarc","status":"pass","evidence":["email.dmarc"]},{"id":"email.mta_sts","status":"pass","evidence":["email.mta_sts","email.mta_sts_policy","email.mx"]},{"id":"email.tls_rpt","status":"pass","evidence":["email.tls_rpt","email.mx"]},{"id":"email.bimi","status":"pass","evidence":["email.bimi","email.mx"]},{"id":"email.dane","status":"not_applicable","findings":["No DANE TLSA records"]},{"id":"email.dnsbl","status":"pass","findings":["zen.spamhaus.org rejected the query (127.255.255.254); results from this zone are unreliable","zone bl.spamcop.net unreachable: timeout","dbl.spamhaus.org rejected the query (127.255.255.254); results from this zone are unreliable"],"evidence":["email.dnsbl","email.dnsbl_domain","email.mx"]},{"id":"email.fcrdns","status":"pass","evidence":["email.fcrdns","email.mx"]},{"id":"http.https_redirect","status":"pass","evidence":["http.port80","http.port80_probe"]},{"id":"http.hsts","status":"pass","evidence":["http.headers","http.hsts"]},{"id":"http.cors","status":"warn","findings":["Allows any origin (Access-Control-Allow-Origin: *)"],"evidence":["http.cors"]},{"id":"http.cookie_secure","status":"not_applicable","findings":["not applicable"],"evidence":["http.cookies"]},{"id":"http.csp","status":"warn","findings":["style-src contains 'unsafe-inline'"],"evidence":["http.headers","http.csp"]},{"id":"http.x_frame_options","status":"pass","evidence":["http.headers"]},{"id":"http.x_content_type_options","status":"pass","evidence":["http.headers"]},{"id":"http.referrer_policy","status":"pass","evidence":["http.headers"]},{"id":"http.permissions_policy","status":"pass","evidence":["http.headers"]},{"id":"http.coop","status":"pass","evidence":["http.headers","http.isolation"]},{"id":"http.deprecated_headers","status":"pass","evidence":["http.headers"]},{"id":"http.info_leakage","status":"pass","evidence":["http.headers"]},{"id":"http.caching","status":"pass","evidence":["http.headers","http.caching"]},{"id":"ip.reputation","status":"pass","evidence":["ip.addresses"]},{"id":"tls.tls_reachable","status":"pass","evidence":["tls.addresses"]},{"id":"tls.chain_trusted","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.not_expired","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.hostname_match","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.chain_complete","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.strong_signature","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.key_strength","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.expiry_window","status":"warn","findings":["130.162.45.139: leaf certificate expires in 30 days"],"evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.cert_lifetime","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.san_quality","status":"pass","evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.aia_reachability","status":"not_applicable","findings":["Chain is complete; AIA URLs not required for verification"],"evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.tls_version","status":"pass","evidence":["tls.handshake@130.162.45.139:443"]},{"id":"tls.forward_secrecy","status":"pass","evidence":["tls.handshake@130.162.45.139:443"]},{"id":"tls.aead_cipher","status":"pass","evidence":["tls.handshake@130.162.45.139:443"]},{"id":"tls.legacy_versions","status":"pass","evidence":["tls.probes@130.162.45.139:443","tls.protocols"]},{"id":"tls.weak_suites","status":"pass","evidence":["tls.probes@130.162.45.139:443","tls.protocols"]},{"id":"tls.ct_logged","status":"pass","evidence":["tls.ct"]},{"id":"tls.ocsp_stapled","status":"not_applicable","findings":["CA does not provide OCSP (CRL only)"],"evidence":["tls.handshake@130.162.45.139:443"]},{"id":"tls.caa_compliant","status":"pass","evidence":["dns.caa"]},{"id":"tls.dane_valid","status":"not_applicable","findings":["DANE check skipped (requires DNSSEC)"],"evidence":["tls.chain@130.162.45.139:443"]},{"id":"tls.consistency","status":"not_applicable","findings":["fewer than 2 IPs inspected"],"evidence":["tls.chain@130.162.45.139:443","tls.handshake@130.162.45.139:443"]},{"id":"tls.alpn_consistency","status":"not_applicable","findings":["fewer than 2 IPs inspected"],"evidence":["tls.handshake@130.162.45.139:443"]},{"id":"tls.ech_advertised","status":"warn","findings":["130.162.45.139: ECH not advertised in HTTPS DNS record"],"evidence":["tls.handshake@130.162.45.139:443","dns.https"]}],"blocks":[{"id":"dns.a","title":"A","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"A"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"130.162.45.139"}}]}},{"id":"dns.aaaa","title":"AAAA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"AAAA"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"2603:c020:8023:6d00:0:c658:5b78:6699"}}]}},{"id":"dns.mx","title":"MX","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"MX"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"10 smtp.google.com."}}]}},{"id":"dns.caa","title":"CAA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"CAA"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"0 iodef \"mailto:hostmaster@netray.info\""}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"CAA"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"0 issue \"letsencrypt.org\""}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"CAA"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"0 issuewild \"letsencrypt.org\""}}]}},{"id":"dns.ns","title":"NS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"dns1.p04.nsone.net."}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"dns2.p04.nsone.net."}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"dns3.p04.nsone.net."}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"dns4.p04.nsone.net."}}]}},{"id":"dns.https","title":"HTTPS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"HTTPS"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"1 . alpn=h2,h3"}}]}},{"id":"dns.cname","title":"CNAME","shape":{"kind":"records","data":[]}},{"id":"dns.dnskey","title":"DNSKEY","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"256 3 13 3u9onSaqbxIlglXMHjh5Plcah8n2pXj0QuBVY/6YTdC6L/eUEYPDh57nOVJ8dd3fkPMrjt2Oij6J9EeLqyeuBw=="}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"257 3 13 t+4DPP+MFZ0Cr7gAXiDYv6HTyXzq/O2ESVRLc/ysuh5xBXKIsjsj5baV1HzhBNo2F7mbsevsEo0/6UEL8+JBmA=="}}]}},{"id":"dns.ds","title":"DS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"DS"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"48553 13 2 A643677CFFCBC4094D04B3C2ECDBEFB5D1B4CE4B09ED633666B94823014427FD"}}]}},{"id":"dns.nsec","title":"NSEC","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"NSEC"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"\\000.netray.info. A NS SOA MX TXT AAAA RRSIG NSEC DNSKEY HTTPS CAA"}}]}},{"id":"dns.nsec3","title":"NSEC3","shape":{"kind":"records","data":[]}},{"id":"dns.soa","title":"SOA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"SOA"},"ttl":{"t":"int","v":600},"data":{"t":"text","v":"dns1.p04.nsone.net. hostmaster.nsone.net. 1775664304 16384 2048 1209600 3600"}}]}},{"id":"dns.svcb","title":"SVCB","shape":{"kind":"records","data":[]}},{"id":"dns.txt","title":"TXT","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"TXT"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"\"google-site-verification=O5UwjQdLJGrAGkEvcA6nTkVARpBcjZhQcTPw3jlII04\""}},{"owner":{"t":"text","v":"netray.info."},"type":{"t":"text","v":"TXT"},"ttl":{"t":"int","v":3600},"data":{"t":"text","v":"\"v=spf1 include:_spf.google.com ~all\""}}]}},{"id":"email.mx","title":"MX","shape":{"kind":"table","data":{"key":"host","columns":["host","preference","cname"],"rows":[[{"t":"text","v":"smtp.google.com"},{"t":"int","v":10},{"t":"text","v":""}]]}}},{"id":"email.mx_addresses","title":"MX addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","host"],"rows":[[{"t":"addr","v":"142.251.127.27"},{"t":"text","v":"smtp.google.com"}],[{"t":"addr","v":"142.251.127.26"},{"t":"text","v":"smtp.google.com"}],[{"t":"addr","v":"2a00:1450:4001:c21::1a"},{"t":"text","v":"smtp.google.com"}],[{"t":"addr","v":"2a00:1450:4001:c21::1b"},{"t":"text","v":"smtp.google.com"}]]}}},{"id":"email.spf","title":"SPF","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=spf1 include:_spf.google.com ~all"}],["authorized_prefixes",{"t":"text","v":"74.125.0.0/16"}],["authorized_prefixes",{"t":"text","v":"209.85.128.0/17"}],["authorized_prefixes",{"t":"text","v":"2001:4860:4864::/56"}],["authorized_prefixes",{"t":"text","v":"2404:6800:4864::/56"}],["authorized_prefixes",{"t":"text","v":"2607:f8b0:4864::/56"}],["authorized_prefixes",{"t":"text","v":"2800:3f0:4864::/56"}],["authorized_prefixes",{"t":"text","v":"2a00:1450:4864::/56"}],["authorized_prefixes",{"t":"text","v":"2c0f:fb50:4864::/56"}],["lookup_count",{"t":"int","v":1}],["void_lookups",{"t":"int","v":0}]]}},{"id":"email.dmarc","title":"DMARC","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=DMARC1; p=reject; rua=mailto:hostmaster@netray.info; ruf=mailto:hostmaster@netray.info"}],["p",{"t":"text","v":"reject"}],["rua",{"t":"text","v":"mailto:hostmaster@netray.info"}],["ruf",{"t":"text","v":"mailto:hostmaster@netray.info"}]]}},{"id":"email.mta_sts","title":"MTA-STS","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=STSv1; id=20260408000000"}],["id",{"t":"text","v":"20260408000000"}],["policy_status",{"t":"int","v":200}],["content_type",{"t":"text","v":"text/plain; charset=utf-8"}]]}},{"id":"email.mta_sts_policy","title":"MTA-STS policy","shape":{"kind":"text","data":"version: STSv1\nmode: enforce\nmx: smtp.google.com\nmax_age: 86400\n"}},{"id":"email.tls_rpt","title":"TLS-RPT","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=TLSRPTv1; rua=mailto:hostmaster@netray.info"}],["rua",{"t":"text","v":"mailto:hostmaster@netray.info"}]]}},{"id":"email.bimi","title":"BIMI","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=BIMI1; l=https://netray.info/bimi-logo.svg"}],["l",{"t":"text","v":"https://netray.info/bimi-logo.svg"}],["logo_fetch",{"t":"text","v":"ok"}]]}},{"id":"email.dnssec","title":"DNSSEC","shape":{"kind":"fields","data":[["dnskey_present",{"t":"bool","v":true}]]}},{"id":"email.dkim","title":"DKIM keys","shape":{"kind":"table","data":{"key":"key","columns":["key","selector","state","key_type","bits"],"rows":[[{"t":"text","v":"google#1"},{"t":"text","v":"google"},{"t":"text","v":"ok"},{"t":"text","v":"rsa"},{"t":"text","v":"2048"}]]}}},{"id":"email.dane","title":"DANE TLSA","shape":{"kind":"table","data":{"key":"record","columns":["record","host","usage","selector","matching_type"],"rows":[]}}},{"id":"email.dnsbl","title":"DNSBL","shape":{"kind":"table","data":{"key":"query","columns":["query","zone","target","answered","answer"],"rows":[[{"t":"text","v":"142.251.127.27@zen.spamhaus.org"},{"t":"text","v":"zen.spamhaus.org"},{"t":"text","v":"142.251.127.27"},{"t":"bool","v":false},{"t":"text","v":"127.255.255.254"}],[{"t":"text","v":"142.251.127.26@zen.spamhaus.org"},{"t":"text","v":"zen.spamhaus.org"},{"t":"text","v":"142.251.127.26"},{"t":"bool","v":false},{"t":"text","v":"127.255.255.254"}],[{"t":"text","v":"142.251.127.27@b.barracudacentral.org"},{"t":"text","v":"b.barracudacentral.org"},{"t":"text","v":"142.251.127.27"},{"t":"bool","v":true},{"t":"text","v":""}],[{"t":"text","v":"142.251.127.26@b.barracudacentral.org"},{"t":"text","v":"b.barracudacentral.org"},{"t":"text","v":"142.251.127.26"},{"t":"bool","v":true},{"t":"text","v":""}],[{"t":"text","v":"142.251.127.27@bl.spamcop.net"},{"t":"text","v":"bl.spamcop.net"},{"t":"text","v":"142.251.127.27"},{"t":"bool","v":false},{"t":"text","v":""}],[{"t":"text","v":"142.251.127.26@bl.spamcop.net"},{"t":"text","v":"bl.spamcop.net"},{"t":"text","v":"142.251.127.26"},{"t":"bool","v":false},{"t":"text","v":""}]]}}},{"id":"email.dnsbl_domain","title":"DNSBL (domain)","shape":{"kind":"table","data":{"key":"query","columns":["query","zone","target","answered","answer"],"rows":[[{"t":"text","v":"netray.info@dbl.spamhaus.org"},{"t":"text","v":"dbl.spamhaus.org"},{"t":"text","v":"netray.info"},{"t":"bool","v":false},{"t":"text","v":"127.255.255.254"}]]}}},{"id":"email.fcrdns","title":"FCrDNS","shape":{"kind":"table","data":{"key":"address","columns":["address","ptr","confirmed"],"rows":[[{"t":"addr","v":"142.251.127.27"},{"t":"text","v":"lcfrai-in-f27.1e100.net."},{"t":"bool","v":true}],[{"t":"addr","v":"142.251.127.26"},{"t":"text","v":"lcfrai-in-f26.1e100.net."},{"t":"bool","v":true}],[{"t":"addr","v":"2a00:1450:4001:c21::1a"},{"t":"text","v":"lcfrai-in-f26.1e100.net."},{"t":"bool","v":true}],[{"t":"addr","v":"2a00:1450:4001:c21::1b"},{"t":"text","v":"lcfrai-in-f27.1e100.net."},{"t":"bool","v":true}]]}}},{"id":"email.summary","title":"Summary","shape":{"kind":"fields","data":[["grade",{"t":"text","v":"A"}]]}},{"id":"http.redirects","title":"Redirects","shape":{"kind":"chain","data":[]}},{"id":"http.port80","title":"Port 80 redirects","shape":{"kind":"chain","data":[[["url",{"t":"text","v":"http://netray.info/"}],["status",{"t":"int","v":301}],["location",{"t":"text","v":"https://netray.info/"}]]]}},{"id":"http.port80_probe","title":"Port 80 probe","shape":{"kind":"fields","data":[["url",{"t":"text","v":"http://netray.info/"}],["status_code",{"t":"int","v":200}],["redirects_to_https",{"t":"bool","v":true}]]}},{"id":"http.headers","title":"Response headers","shape":{"kind":"table","data":{"key":"name","columns":["name","value"],"rows":[[{"t":"text","v":"access-control-allow-origin"},{"t":"text","v":"*"}],[{"t":"text","v":"cache-control"},{"t":"text","v":"no-cache"}],[{"t":"text","v":"content-encoding"},{"t":"text","v":"gzip"}],[{"t":"text","v":"content-security-policy"},{"t":"text","v":"default-src 'self'; script-src 'self' 'sha256-FBZufGszYN+NT1Qfwwcpw8g3UwIyffzP+zXtvQP53zc='; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src 'self' https://stats.uptimerobot.com; frame-ancestors 'none'; base-uri 'self'; object-src 'none'; form-action 'self' https://netray.info https://*.netray.info"}],[{"t":"text","v":"content-type"},{"t":"text","v":"text/html; charset=utf-8"}],[{"t":"text","v":"cross-origin-opener-policy"},{"t":"text","v":"same-origin"}],[{"t":"text","v":"cross-origin-resource-policy"},{"t":"text","v":"cross-origin"}],[{"t":"text","v":"date"},{"t":"text","v":"Fri, 06 Nov 2026 01:33:18 GMT"}],[{"t":"text","v":"permissions-policy"},{"t":"text","v":"camera=(), microphone=(), geolocation=(), payment=()"}],[{"t":"text","v":"referrer-policy"},{"t":"text","v":"strict-origin-when-cross-origin"}],[{"t":"text","v":"strict-transport-security"},{"t":"text","v":"max-age=31536000; includeSubDomains; preload"}],[{"t":"text","v":"vary"},{"t":"text","v":"accept-encoding, origin, access-control-request-method, access-control-request-headers"}],[{"t":"text","v":"x-content-type-options"},{"t":"text","v":"nosniff"}],[{"t":"text","v":"x-frame-options"},{"t":"text","v":"DENY"}],[{"t":"text","v":"x-request-id"},{"t":"text","v":"01a1ae7d-1fa5-727e-ab39-1ba31b0ef202"}]]}}},{"id":"http.csp","title":"Content Security Policy","shape":{"kind":"tree","data":{"fields":[["report_only",{"t":"bool","v":false}],["issue_count",{"t":"int","v":1}]],"children":[{"fields":[["directive",{"t":"text","v":"default-src"}],["source",{"t":"text","v":"'self'"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"script-src"}],["source",{"t":"text","v":"'self'"}],["source",{"t":"text","v":"'sha256-FBZufGszYN+NT1Qfwwcpw8g3UwIyffzP+zXtvQP53zc='"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"style-src"}],["source",{"t":"text","v":"'self'"}],["source",{"t":"text","v":"'unsafe-inline'"}],["issue",{"t":"text","v":"style-src contains 'unsafe-inline'"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"font-src"}],["source",{"t":"text","v":"'self'"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"img-src"}],["source",{"t":"text","v":"'self'"}],["source",{"t":"text","v":"data:"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"connect-src"}],["source",{"t":"text","v":"'self'"}],["source",{"t":"text","v":"https://stats.uptimerobot.com"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"frame-ancestors"}],["source",{"t":"text","v":"'none'"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"base-uri"}],["source",{"t":"text","v":"'self'"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"object-src"}],["source",{"t":"text","v":"'none'"}]],"children":[]},{"fields":[["directive",{"t":"text","v":"form-action"}],["source",{"t":"text","v":"'self'"}],["source",{"t":"text","v":"https://netray.info"}],["source",{"t":"text","v":"https://*.netray.info"}]],"children":[]}]}}},{"id":"http.hsts","title":"HSTS","shape":{"kind":"fields","data":[["max_age",{"t":"int","v":31536000}],["include_subdomains",{"t":"bool","v":true}],["preload",{"t":"bool","v":true}]]}},{"id":"http.caching","title":"Caching","shape":{"kind":"fields","data":[["directive",{"t":"text","v":"no-cache"}],["vary",{"t":"text","v":"accept-encoding"}],["vary",{"t":"text","v":"origin"}],["vary",{"t":"text","v":"access-control-request-method"}],["vary",{"t":"text","v":"access-control-request-headers"}]]}},{"id":"http.isolation","title":"Cross-origin isolation","shape":{"kind":"fields","data":[["coop",{"t":"text","v":"same-origin"}],["corp",{"t":"text","v":"cross-origin"}],["missing",{"t":"text","v":"cross-origin-embedder-policy"}]]}},{"id":"http.server","title":"Server","shape":{"kind":"fields","data":[["final_url",{"t":"text","v":"https://netray.info/"}],["status_code",{"t":"int","v":200}],["http_version",{"t":"text","v":"h2"}],["inspection_ms",{"t":"duration","v":444}],["address",{"t":"addr","v":"130.162.45.139"}],["org",{"t":"text","v":"Oracle Corporation"}],["network_type",{"t":"text","v":"cloud"}]]}},{"id":"http.cors","title":"CORS","shape":{"kind":"fields","data":[["allows_any_origin",{"t":"bool","v":true}],["reflects_origin",{"t":"bool","v":false}],["allows_credentials",{"t":"bool","v":false}],["allow_origin",{"t":"text","v":"*"}]]}},{"id":"http.cookies","title":"Cookies","shape":{"kind":"table","data":{"key":"cookie","columns":["cookie","name","secure","http_only","same_site"],"rows":[]}}},{"id":"ip.addresses","title":"Addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","asn","org","prefix","network_type","country","city","spamhaus","c2","tor","vpn"],"rows":[[{"t":"addr","v":"130.162.45.139"},{"t":"text","v":"AS31898"},{"t":"text","v":"Oracle Corporation"},{"t":"text","v":"130.162.32.0/19"},{"t":"text","v":"cloud"},{"t":"text","v":"Germany"},{"t":"text","v":"Frankfurt am Main"},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"2603:c020:8023:6d00:0:c658:5b78:6699"},{"t":"text","v":"AS31898"},{"t":"text","v":"Oracle Corporation"},{"t":"text","v":"2603:c020:8000::/35"},{"t":"text","v":"datacenter"},{"t":"text","v":"Germany"},{"t":"text","v":"Frankfurt am Main"},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}]]}}},{"id":"tls.addresses","title":"Addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","port","outcome","message"],"rows":[[{"t":"addr","v":"130.162.45.139"},{"t":"int","v":443},{"t":"text","v":"ok"},{"t":"text","v":""}],[{"t":"addr","v":"2603:c020:8023:6d00:0:c658:5b78:6699"},{"t":"int","v":443},{"t":"text","v":"NOT_TESTED_FROM_HERE"},{"t":"text","v":"Network unreachable (os error 101)"}]]}}},{"id":"tls.chain@130.162.45.139:443","title":"Certificate chain 130.162.45.139:443","shape":{"kind":"chain","data":[[["position",{"t":"text","v":"leaf"}],["subject",{"t":"text","v":"CN=netray.info"}],["issuer",{"t":"text","v":"C=US, O=Let's Encrypt, CN=YR2"}],["sans",{"t":"text","v":"netray.info"}],["not_before",{"t":"time","v":"2026-09-07T21:47:50Z"}],["not_after",{"t":"time","v":"2026-12-06T21:47:49Z"}],["days_remaining",{"t":"int","v":30}],["key",{"t":"text","v":"RSA 4096"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"01:85:DC:66:B0:87:75:B9:57:8A:6F:8A:6B:F9:42:40:69:38:BA:82:12:C6:8A:84:39:29:EE:90:85:90:BD:76"}],["fingerprint_sha1",{"t":"text","v":"6C:BB:59:A5:4D:EA:27:01:32:CA:FB:3B:84:36:7C:0F:AF:02:CB:88"}],["serial",{"t":"text","v":"05:A4:2F:BC:F3:FE:DD:E3:32:EE:77:E9:91:67:6B:41:61:E6"}],["policy",{"t":"text","v":"DV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://yr2.i.lencr.org/"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=Let's Encrypt, CN=YR2"}],["issuer",{"t":"text","v":"C=US, O=ISRG, CN=Root YR"}],["not_before",{"t":"time","v":"2025-09-03T00:00:00Z"}],["not_after",{"t":"time","v":"2028-09-02T23:59:59Z"}],["days_remaining",{"t":"int","v":666}],["key",{"t":"text","v":"RSA 2048"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"23:8B:85:A0:09:9C:65:B9:70:47:7D:57:24:F1:A1:D4:75:CE:50:58:CF:FE:4E:FA:87:33:89:9B:DB:86:3C:47"}],["fingerprint_sha1",{"t":"text","v":"2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37"}],["serial",{"t":"text","v":"4E:BD:24:94:7E:24:D3:94:80:2D:84:A5:2F:D5:B3:19"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://yr.i.lencr.org/"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=ISRG, CN=Root YR"}],["issuer",{"t":"text","v":"C=US, O=Internet Security Research Group, CN=ISRG Root X1"}],["not_before",{"t":"time","v":"2026-05-13T00:00:00Z"}],["not_after",{"t":"time","v":"2032-09-02T23:59:59Z"}],["days_remaining",{"t":"int","v":2127}],["key",{"t":"text","v":"RSA 4096"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"07:26:39:D0:B1:40:D5:BF:FA:E1:6A:D9:C3:F6:CC:60:86:04:06:21:F5:1E:E6:1A:6D:46:A8:91:5C:07:CF:76"}],["fingerprint_sha1",{"t":"text","v":"AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98"}],["serial",{"t":"text","v":"00:F2:4B:6D:17:F9:D9:AD:7C:B1:C9:FE:A7:87:82:69:9F"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://x1.i.lencr.org/"}]]]}},{"id":"tls.handshake@130.162.45.139:443","title":"Handshake 130.162.45.139:443","shape":{"kind":"fields","data":[["version",{"t":"text","v":"TLSv1.3"}],["cipher_suite",{"t":"text","v":"TLS13_AES_128_GCM_SHA256"}],["key_exchange_group",{"t":"text","v":"X25519"}],["sni",{"t":"text","v":"netray.info"}],["ocsp_stapled",{"t":"bool","v":false}],["ech",{"t":"bool","v":false}],["handshake_ms",{"t":"duration","v":127}]]}},{"id":"tls.probes@130.162.45.139:443","title":"Protocol probes 130.162.45.139:443","shape":{"kind":"fields","data":[["ssl3",{"t":"text","v":"disabled"}],["ssl3_answer",{"t":"text","v":"alert protocol_version"}],["tls1_0",{"t":"text","v":"disabled"}],["tls1_0_answer",{"t":"text","v":"alert protocol_version"}],["tls1_1",{"t":"text","v":"disabled"}],["tls1_1_answer",{"t":"text","v":"alert protocol_version"}],["tls1_2",{"t":"text","v":"enabled"}],["tls1_2_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}],["tls1_3",{"t":"text","v":"enabled"}],["tls1_3_answer",{"t":"text","v":"handshake TLSv1.3"}],["suites_insecure",{"t":"text","v":"refused"}],["suites_insecure_answer",{"t":"text","v":"alert handshake_failure"}],["suites_cbc",{"t":"text","v":"refused"}],["suites_cbc_answer",{"t":"text","v":"alert handshake_failure"}],["suites_static_rsa",{"t":"text","v":"refused"}],["suites_static_rsa_answer",{"t":"text","v":"alert handshake_failure"}]]}},{"id":"tls.protocols","title":"Protocols and features","shape":{"kind":"fields","data":[["ssl3",{"t":"text","v":"disabled"}],["tls1_0",{"t":"text","v":"disabled"}],["tls1_1",{"t":"text","v":"disabled"}],["tls1_2",{"t":"text","v":"enabled"}],["tls1_3",{"t":"text","v":"enabled"}],["suites_insecure",{"t":"text","v":"refused"}],["suites_cbc",{"t":"text","v":"refused"}],["suites_static_rsa",{"t":"text","v":"refused"}],["forward_secrecy_all_suites",{"t":"bool","v":true}]]}},{"id":"tls.ct","title":"Certificate Transparency","shape":{"kind":"table","data":{"key":"address","columns":["address","sct_count","log_ids"],"rows":[[{"t":"addr","v":"130.162.45.139"},{"t":"int","v":2},{"t":"text","v":"d809553b944f7affc816196f944f85abb0f8fc5e8755260f15d12e72bb454b14, 6cfe501943a85ea916bc52d133e4dcc91ef1411c7d258420d173809e1818eb3a"}]]}}}]}}
run of 2026-11-06 01:33 UTC entry WjP1e44d
pass
TLS·12
Chain trusted
pass
TLS·13
Certificate valid
pass
TLS·14
Hostname match
pass
TLS·15
Chain complete
pass
TLS·16
Strong signature
pass
TLS·17
Key strength
warn
TLS·18
Expiry window
130.162.45.139: leaf certificate expires in 30 days
Fix: Renew the certificate now and automate future renewals.
pass
TLS·19
Certificate lifetime
pass
TLS·20
SAN quality
untested
TLS·21
AIA reachable
Chain is complete; AIA URLs not required for verification
pass
TLS·22
TLS version
pass
TLS·23
Forward secrecy
pass
TLS·24
AEAD cipher
pass
TLS·25
Legacy protocol versions
pass
TLS·26
Weak cipher suites
untested
TLS·27
OCSP stapling
CA does not provide OCSP (CRL only)
pass
TLS·28
CT logged
pass
TLS·29
CAA compliant
untested
TLS·30
DANE valid
DANE check skipped (requires DNSSEC)
untested
TLS·31
Multi-IP consistency
fewer than 2 IPs inspected
untested
TLS·32
ALPN consistency
fewer than 2 IPs inspected
warn
TLS·33
ECH advertised
130.162.45.139: ECH not advertised in HTTPS DNS record
Fix: Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server.
Addresses
| Address | Band | Protocol | Cipher | Leaf |
|---|---|---|---|---|
| 130.162.45.139 | TLSv1.3 | TLS13_AES_128_GCM_SHA256 | SHA256 01:85:…:76 | |
| 2603:c020:8023:6d00:0:c658:5b78:6699 | NOT_TESTED_FROM_HERE Network unreachable (os error 101) | |||
Port 443 · handshake 127 ms
Feeds lines: Reach
Certificate
not before 2026-09-07today · 30 days leftnot after 2026-12-06
the last 30 days turn the expiry line amber
SubjectCN=netray.info
Alternative namesnetray.info
IssuerC=US, O=Let's Encrypt, CN=YR2
KeyRSA 4096
Signaturesha256WithRSAEncryption
OCSPnot stapled
Certificate Transparency2 SCTs
Serial05:A4:2F:BC:F3:FE:DD:E3:32:EE:77:E9:91:67:6B:41:61:E6
SHA-25601:85:DC:66:B0:87:75:B9:57:8A:6F:8A:6B:F9:42:40:69:38:BA:82:12:C6:8A:84:39:29:EE:90:85:90:BD:76
SHA-16C:BB:59:A5:4D:EA:27:01:32:CA:FB:3B:84:36:7C:0F:AF:02:CB:88
PolicyDV
CA issuershttp://yr2.i.lencr.org/
SCT logsd809553b944f7affc816196f944f85abb0f8fc5e8755260f15d12e72bb454b14, 6cfe501943a85ea916bc52d133e4dcc91ef1411c7d258420d173809e1818eb3a
Chain
Chain certificates
YR2
SubjectC=US, O=Let's Encrypt, CN=YR2
IssuerC=US, O=ISRG, CN=Root YR
Not before2025-09-03
Not after2028-09-02
Days left666 days
KeyRSA 2048
Signaturesha256WithRSAEncryption
Serial4E:BD:24:94:7E:24:D3:94:80:2D:84:A5:2F:D5:B3:19
SHA-25623:8B:85:A0:09:9C:65:B9:70:47:7D:57:24:F1:A1:D4:75:CE:50:58:CF:FE:4E:FA:87:33:89:9B:DB:86:3C:47
SHA-12D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37
PolicyOV
CA issuershttp://yr.i.lencr.org/
Root YR
SubjectC=US, O=ISRG, CN=Root YR
IssuerC=US, O=Internet Security Research Group, CN=ISRG Root X1
Not before2026-05-13
Not after2032-09-02
Days left2127 days
KeyRSA 4096
Signaturesha256WithRSAEncryption
Serial00:F2:4B:6D:17:F9:D9:AD:7C:B1:C9:FE:A7:87:82:69:9F
SHA-25607:26:39:D0:B1:40:D5:BF:FA:E1:6A:D9:C3:F6:CC:60:86:04:06:21:F5:1E:E6:1A:6D:46:A8:91:5C:07:CF:76
SHA-1AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98
PolicyOV
CA issuershttp://x1.i.lencr.org/
Protocols and features
TLS 1.3enabled
TLS 1.2enabled
TLS 1.1disabled, as it should be
TLS 1.0disabled, as it should be
ALPNnone
Forward secrecyall suites
Encrypted Client Hellonot advertised
SSL 3.0disabled
Cipher suitesinsecure refused · CBC refused · static RSA refused
Key exchangeX25519
SNInetray.info
Probe answers
| Probe | 130.162.45.139 |
|---|---|
| SSL 3.0 | disabled alert protocol_version |
| TLS 1.0 | disabled alert protocol_version |
| TLS 1.1 | disabled alert protocol_version |
| TLS 1.2 | enabled server_hello TLSv1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS 1.3 | enabled handshake TLSv1.3 |
| insecure suites | refused alert handshake_failure |
| CBC suites | refused alert handshake_failure |
| static RSA suites | refused alert handshake_failure |