pass
TLS·11
example.com · tls
# example.com · tls
## Checks
| Code | Check | Status | Finding | Fix |
|---|---|---|---|---|
| TLS·11 | TLS reachable | pass | | |
| TLS·12 | Chain trusted | pass | | |
| TLS·13 | Certificate valid | pass | | |
| TLS·14 | Hostname match | pass | | |
| TLS·15 | Chain complete | pass | | |
| TLS·16 | Strong signature | pass | | |
| TLS·17 | Key strength | pass | | |
| TLS·18 | Expiry window | pass | | |
| TLS·19 | Certificate lifetime | pass | | |
| TLS·20 | SAN quality | pass | | |
| TLS·21 | AIA reachable | not\_applicable | Chain is complete; AIA URLs not required for verification | |
| TLS·22 | TLS version | pass | | |
| TLS·23 | Forward secrecy | pass | | |
| TLS·24 | AEAD cipher | pass | | |
| TLS·25 | Legacy protocol versions | fail | 172.66.147.243: accepts TLS 1.0, TLS 1.1 | Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3. |
| TLS·26 | Weak cipher suites | warn | 172.66.147.243: accepts CBC suite TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA; 172.66.147.243: accepts static RSA suite TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 | Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites. |
| TLS·27 | OCSP stapling | pass | | |
| TLS·28 | CT logged | pass | | |
| TLS·29 | CAA compliant | pass | | |
| TLS·30 | DANE valid | not\_applicable | DANE check skipped (requires DNSSEC) | |
| TLS·31 | Multi-IP consistency | pass | | |
| TLS·32 | ALPN consistency | pass | | |
| TLS·33 | ECH advertised | warn | 172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record | Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server. |
## Addresses
| address | port | outcome | message |
|---|---|---|---|
| 172.66.147.243 | 443 | ok | |
| 2606:4700:10::ac42:93f3 | 443 | NOT\_TESTED\_FROM\_HERE | Network unreachable (os error 101) |
| 104.20.23.154 | 443 | ok | |
## Certificate chain 172.66.147.243:443
- position: leaf, subject: CN=example.com, issuer: C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3, sans: example.com, sans: \*.example.com, not\_before: 2026-09-26T22:49:11Z, not\_after: 2026-12-25T22:56:35Z, days\_remaining: 49, key: ECDSA P-256 256, signature\_algorithm: ecdsa-with-SHA256, fingerprint\_sha256: 85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A, fingerprint\_sha1: 89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D, serial: 01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90, policy: DV, self\_signed: false, expired: false, ocsp\_url: http://o.cf-i.ssl.com, ca\_issuers\_url: http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
- position: intermediate, subject: C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3, issuer: C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2, not\_before: 2025-05-29T19:49:45Z, not\_after: 2035-05-27T19:49:44Z, days\_remaining: 3123, key: ECDSA P-256 256, signature\_algorithm: ecdsa-with-SHA384, fingerprint\_sha256: F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26, fingerprint\_sha1: AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08, serial: 31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27, policy: OV, self\_signed: false, expired: false, ca\_issuers\_url: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- position: intermediate, subject: C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2, issuer: C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022, not\_before: 2022-10-21T17:02:23Z, not\_after: 2037-10-17T17:02:22Z, days\_remaining: 3997, key: ECDSA P-384 384, signature\_algorithm: ecdsa-with-SHA384, fingerprint\_sha256: 5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92, fingerprint\_sha1: E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8, serial: 60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E, policy: OV, self\_signed: false, expired: false, ca\_issuers\_url: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- position: intermediate, subject: C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022, issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services, not\_before: 2025-08-01T00:00:00Z, not\_after: 2028-12-31T23:59:59Z, days\_remaining: 786, key: ECDSA P-384 384, signature\_algorithm: sha256WithRSAEncryption, fingerprint\_sha256: BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8, fingerprint\_sha1: 5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC, serial: 17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E, policy: EV, self\_signed: false, expired: false, ocsp\_url: http://ocsp.comodoca.com
## Handshake 172.66.147.243:443
| Field | Value |
|---|---|
| version | TLSv1.3 |
| cipher\_suite | TLS13\_AES\_256\_GCM\_SHA384 |
| key\_exchange\_group | X25519 |
| sni | example.com |
| ocsp\_stapled | true |
| ocsp\_status | good |
| ocsp\_this\_update | 2026-11-02T19:22:00Z |
| ocsp\_next\_update | 2026-11-09T19:22:00Z |
| ocsp\_live\_status | good |
| ech | false |
| handshake\_ms | 21 ms |
## Certificate chain 104.20.23.154:443
- position: leaf, subject: CN=example.com, issuer: C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3, sans: example.com, sans: \*.example.com, not\_before: 2026-09-26T22:49:11Z, not\_after: 2026-12-25T22:56:35Z, days\_remaining: 49, key: ECDSA P-256 256, signature\_algorithm: ecdsa-with-SHA256, fingerprint\_sha256: 85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A, fingerprint\_sha1: 89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D, serial: 01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90, policy: DV, self\_signed: false, expired: false, ocsp\_url: http://o.cf-i.ssl.com, ca\_issuers\_url: http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
- position: intermediate, subject: C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3, issuer: C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2, not\_before: 2025-05-29T19:49:45Z, not\_after: 2035-05-27T19:49:44Z, days\_remaining: 3123, key: ECDSA P-256 256, signature\_algorithm: ecdsa-with-SHA384, fingerprint\_sha256: F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26, fingerprint\_sha1: AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08, serial: 31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27, policy: OV, self\_signed: false, expired: false, ca\_issuers\_url: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- position: intermediate, subject: C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2, issuer: C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022, not\_before: 2022-10-21T17:02:23Z, not\_after: 2037-10-17T17:02:22Z, days\_remaining: 3997, key: ECDSA P-384 384, signature\_algorithm: ecdsa-with-SHA384, fingerprint\_sha256: 5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92, fingerprint\_sha1: E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8, serial: 60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E, policy: OV, self\_signed: false, expired: false, ca\_issuers\_url: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- position: intermediate, subject: C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022, issuer: C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services, not\_before: 2025-08-01T00:00:00Z, not\_after: 2028-12-31T23:59:59Z, days\_remaining: 786, key: ECDSA P-384 384, signature\_algorithm: sha256WithRSAEncryption, fingerprint\_sha256: BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8, fingerprint\_sha1: 5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC, serial: 17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E, policy: EV, self\_signed: false, expired: false, ocsp\_url: http://ocsp.comodoca.com
## Handshake 104.20.23.154:443
| Field | Value |
|---|---|
| version | TLSv1.3 |
| cipher\_suite | TLS13\_AES\_256\_GCM\_SHA384 |
| key\_exchange\_group | X25519 |
| sni | example.com |
| ocsp\_stapled | true |
| ocsp\_status | good |
| ocsp\_this\_update | 2026-11-02T19:22:00Z |
| ocsp\_next\_update | 2026-11-09T19:22:00Z |
| ocsp\_live\_status | good |
| ech | false |
| handshake\_ms | 6 ms |
## Protocol probes 172.66.147.243:443
| Field | Value |
|---|---|
| ssl3 | disabled |
| ssl3\_answer | alert handshake\_failure |
| tls1\_0 | enabled |
| tls1\_0\_answer | server\_hello TLSv1.0 TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA |
| tls1\_1 | enabled |
| tls1\_1\_answer | server\_hello TLSv1.1 TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA |
| tls1\_2 | enabled |
| tls1\_2\_answer | server\_hello TLSv1.2 TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256 |
| tls1\_3 | enabled |
| tls1\_3\_answer | handshake TLSv1.3 |
| suites\_insecure | refused |
| suites\_insecure\_answer | alert handshake\_failure |
| suites\_cbc | accepted |
| suites\_cbc\_answer | server\_hello TLSv1.2 TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA |
| suites\_static\_rsa | accepted |
| suites\_static\_rsa\_answer | server\_hello TLSv1.2 TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 |
## Protocols and features
| Field | Value |
|---|---|
| ssl3 | disabled |
| tls1\_0 | enabled |
| tls1\_1 | enabled |
| tls1\_2 | enabled |
| tls1\_3 | enabled |
| suites\_insecure | refused |
| suites\_cbc | accepted |
| suites\_static\_rsa | accepted |
| forward\_secrecy\_all\_suites | false |
## Certificate Transparency
| address | sct\_count | log\_ids |
|---|---|---|
| 172.66.147.243 | 2 | 944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7 |
| 104.20.23.154 | 2 | 944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7 |
## CAA
| Owner | Type | TTL | Data |
|---|---|---|---|
section,item,field,value
checks,tls.tls_reachable,status,pass
checks,tls.tls_reachable,finding,
checks,tls.tls_reachable,fix,
checks,tls.chain_trusted,status,pass
checks,tls.chain_trusted,finding,
checks,tls.chain_trusted,fix,
checks,tls.not_expired,status,pass
checks,tls.not_expired,finding,
checks,tls.not_expired,fix,
checks,tls.hostname_match,status,pass
checks,tls.hostname_match,finding,
checks,tls.hostname_match,fix,
checks,tls.chain_complete,status,pass
checks,tls.chain_complete,finding,
checks,tls.chain_complete,fix,
checks,tls.strong_signature,status,pass
checks,tls.strong_signature,finding,
checks,tls.strong_signature,fix,
checks,tls.key_strength,status,pass
checks,tls.key_strength,finding,
checks,tls.key_strength,fix,
checks,tls.expiry_window,status,pass
checks,tls.expiry_window,finding,
checks,tls.expiry_window,fix,
checks,tls.cert_lifetime,status,pass
checks,tls.cert_lifetime,finding,
checks,tls.cert_lifetime,fix,
checks,tls.san_quality,status,pass
checks,tls.san_quality,finding,
checks,tls.san_quality,fix,
checks,tls.aia_reachability,status,not_applicable
checks,tls.aia_reachability,finding,Chain is complete; AIA URLs not required for verification
checks,tls.aia_reachability,fix,
checks,tls.tls_version,status,pass
checks,tls.tls_version,finding,
checks,tls.tls_version,fix,
checks,tls.forward_secrecy,status,pass
checks,tls.forward_secrecy,finding,
checks,tls.forward_secrecy,fix,
checks,tls.aead_cipher,status,pass
checks,tls.aead_cipher,finding,
checks,tls.aead_cipher,fix,
checks,tls.legacy_versions,status,fail
checks,tls.legacy_versions,finding,"172.66.147.243: accepts TLS 1.0, TLS 1.1"
checks,tls.legacy_versions,fix,"Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3."
checks,tls.weak_suites,status,warn
checks,tls.weak_suites,finding,172.66.147.243: accepts CBC suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA; 172.66.147.243: accepts static RSA suite TLS_RSA_WITH_AES_128_GCM_SHA256
checks,tls.weak_suites,fix,"Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites."
checks,tls.ocsp_stapled,status,pass
checks,tls.ocsp_stapled,finding,
checks,tls.ocsp_stapled,fix,
checks,tls.ct_logged,status,pass
checks,tls.ct_logged,finding,
checks,tls.ct_logged,fix,
checks,tls.caa_compliant,status,pass
checks,tls.caa_compliant,finding,
checks,tls.caa_compliant,fix,
checks,tls.dane_valid,status,not_applicable
checks,tls.dane_valid,finding,DANE check skipped (requires DNSSEC)
checks,tls.dane_valid,fix,
checks,tls.consistency,status,pass
checks,tls.consistency,finding,
checks,tls.consistency,fix,
checks,tls.alpn_consistency,status,pass
checks,tls.alpn_consistency,finding,
checks,tls.alpn_consistency,fix,
checks,tls.ech_advertised,status,warn
checks,tls.ech_advertised,finding,172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record
checks,tls.ech_advertised,fix,"Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server."
tls.addresses,172.66.147.243,address,172.66.147.243
tls.addresses,172.66.147.243,port,443
tls.addresses,172.66.147.243,outcome,ok
tls.addresses,172.66.147.243,message,
tls.addresses,2606:4700:10::ac42:93f3,address,2606:4700:10::ac42:93f3
tls.addresses,2606:4700:10::ac42:93f3,port,443
tls.addresses,2606:4700:10::ac42:93f3,outcome,NOT_TESTED_FROM_HERE
tls.addresses,2606:4700:10::ac42:93f3,message,Network unreachable (os error 101)
tls.addresses,104.20.23.154,address,104.20.23.154
tls.addresses,104.20.23.154,port,443
tls.addresses,104.20.23.154,outcome,ok
tls.addresses,104.20.23.154,message,
tls.chain@172.66.147.243:443,0,position,leaf
tls.chain@172.66.147.243:443,0,subject,CN=example.com
tls.chain@172.66.147.243:443,0,issuer,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@172.66.147.243:443,0,sans,example.com
tls.chain@172.66.147.243:443,0,sans,*.example.com
tls.chain@172.66.147.243:443,0,not_before,2026-09-26T22:49:11Z
tls.chain@172.66.147.243:443,0,not_after,2026-12-25T22:56:35Z
tls.chain@172.66.147.243:443,0,days_remaining,49
tls.chain@172.66.147.243:443,0,key,ECDSA P-256 256
tls.chain@172.66.147.243:443,0,signature_algorithm,ecdsa-with-SHA256
tls.chain@172.66.147.243:443,0,fingerprint_sha256,85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A
tls.chain@172.66.147.243:443,0,fingerprint_sha1,89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D
tls.chain@172.66.147.243:443,0,serial,01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90
tls.chain@172.66.147.243:443,0,policy,DV
tls.chain@172.66.147.243:443,0,self_signed,false
tls.chain@172.66.147.243:443,0,expired,false
tls.chain@172.66.147.243:443,0,ocsp_url,http://o.cf-i.ssl.com
tls.chain@172.66.147.243:443,0,ca_issuers_url,http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
tls.chain@172.66.147.243:443,1,position,intermediate
tls.chain@172.66.147.243:443,1,subject,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@172.66.147.243:443,1,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@172.66.147.243:443,1,not_before,2025-05-29T19:49:45Z
tls.chain@172.66.147.243:443,1,not_after,2035-05-27T19:49:44Z
tls.chain@172.66.147.243:443,1,days_remaining,3123
tls.chain@172.66.147.243:443,1,key,ECDSA P-256 256
tls.chain@172.66.147.243:443,1,signature_algorithm,ecdsa-with-SHA384
tls.chain@172.66.147.243:443,1,fingerprint_sha256,F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26
tls.chain@172.66.147.243:443,1,fingerprint_sha1,AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08
tls.chain@172.66.147.243:443,1,serial,31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27
tls.chain@172.66.147.243:443,1,policy,OV
tls.chain@172.66.147.243:443,1,self_signed,false
tls.chain@172.66.147.243:443,1,expired,false
tls.chain@172.66.147.243:443,1,ca_issuers_url,http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
tls.chain@172.66.147.243:443,2,position,intermediate
tls.chain@172.66.147.243:443,2,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@172.66.147.243:443,2,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@172.66.147.243:443,2,not_before,2022-10-21T17:02:23Z
tls.chain@172.66.147.243:443,2,not_after,2037-10-17T17:02:22Z
tls.chain@172.66.147.243:443,2,days_remaining,3997
tls.chain@172.66.147.243:443,2,key,ECDSA P-384 384
tls.chain@172.66.147.243:443,2,signature_algorithm,ecdsa-with-SHA384
tls.chain@172.66.147.243:443,2,fingerprint_sha256,5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92
tls.chain@172.66.147.243:443,2,fingerprint_sha1,E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8
tls.chain@172.66.147.243:443,2,serial,60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E
tls.chain@172.66.147.243:443,2,policy,OV
tls.chain@172.66.147.243:443,2,self_signed,false
tls.chain@172.66.147.243:443,2,expired,false
tls.chain@172.66.147.243:443,2,ca_issuers_url,http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
tls.chain@172.66.147.243:443,3,position,intermediate
tls.chain@172.66.147.243:443,3,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@172.66.147.243:443,3,issuer,"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"
tls.chain@172.66.147.243:443,3,not_before,2025-08-01T00:00:00Z
tls.chain@172.66.147.243:443,3,not_after,2028-12-31T23:59:59Z
tls.chain@172.66.147.243:443,3,days_remaining,786
tls.chain@172.66.147.243:443,3,key,ECDSA P-384 384
tls.chain@172.66.147.243:443,3,signature_algorithm,sha256WithRSAEncryption
tls.chain@172.66.147.243:443,3,fingerprint_sha256,BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8
tls.chain@172.66.147.243:443,3,fingerprint_sha1,5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC
tls.chain@172.66.147.243:443,3,serial,17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E
tls.chain@172.66.147.243:443,3,policy,EV
tls.chain@172.66.147.243:443,3,self_signed,false
tls.chain@172.66.147.243:443,3,expired,false
tls.chain@172.66.147.243:443,3,ocsp_url,http://ocsp.comodoca.com
tls.handshake@172.66.147.243:443,,version,TLSv1.3
tls.handshake@172.66.147.243:443,,cipher_suite,TLS13_AES_256_GCM_SHA384
tls.handshake@172.66.147.243:443,,key_exchange_group,X25519
tls.handshake@172.66.147.243:443,,sni,example.com
tls.handshake@172.66.147.243:443,,ocsp_stapled,true
tls.handshake@172.66.147.243:443,,ocsp_status,good
tls.handshake@172.66.147.243:443,,ocsp_this_update,2026-11-02T19:22:00Z
tls.handshake@172.66.147.243:443,,ocsp_next_update,2026-11-09T19:22:00Z
tls.handshake@172.66.147.243:443,,ocsp_live_status,good
tls.handshake@172.66.147.243:443,,ech,false
tls.handshake@172.66.147.243:443,,handshake_ms,21 ms
tls.chain@104.20.23.154:443,0,position,leaf
tls.chain@104.20.23.154:443,0,subject,CN=example.com
tls.chain@104.20.23.154:443,0,issuer,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@104.20.23.154:443,0,sans,example.com
tls.chain@104.20.23.154:443,0,sans,*.example.com
tls.chain@104.20.23.154:443,0,not_before,2026-09-26T22:49:11Z
tls.chain@104.20.23.154:443,0,not_after,2026-12-25T22:56:35Z
tls.chain@104.20.23.154:443,0,days_remaining,49
tls.chain@104.20.23.154:443,0,key,ECDSA P-256 256
tls.chain@104.20.23.154:443,0,signature_algorithm,ecdsa-with-SHA256
tls.chain@104.20.23.154:443,0,fingerprint_sha256,85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A
tls.chain@104.20.23.154:443,0,fingerprint_sha1,89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D
tls.chain@104.20.23.154:443,0,serial,01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90
tls.chain@104.20.23.154:443,0,policy,DV
tls.chain@104.20.23.154:443,0,self_signed,false
tls.chain@104.20.23.154:443,0,expired,false
tls.chain@104.20.23.154:443,0,ocsp_url,http://o.cf-i.ssl.com
tls.chain@104.20.23.154:443,0,ca_issuers_url,http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
tls.chain@104.20.23.154:443,1,position,intermediate
tls.chain@104.20.23.154:443,1,subject,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@104.20.23.154:443,1,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@104.20.23.154:443,1,not_before,2025-05-29T19:49:45Z
tls.chain@104.20.23.154:443,1,not_after,2035-05-27T19:49:44Z
tls.chain@104.20.23.154:443,1,days_remaining,3123
tls.chain@104.20.23.154:443,1,key,ECDSA P-256 256
tls.chain@104.20.23.154:443,1,signature_algorithm,ecdsa-with-SHA384
tls.chain@104.20.23.154:443,1,fingerprint_sha256,F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26
tls.chain@104.20.23.154:443,1,fingerprint_sha1,AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08
tls.chain@104.20.23.154:443,1,serial,31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27
tls.chain@104.20.23.154:443,1,policy,OV
tls.chain@104.20.23.154:443,1,self_signed,false
tls.chain@104.20.23.154:443,1,expired,false
tls.chain@104.20.23.154:443,1,ca_issuers_url,http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
tls.chain@104.20.23.154:443,2,position,intermediate
tls.chain@104.20.23.154:443,2,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@104.20.23.154:443,2,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@104.20.23.154:443,2,not_before,2022-10-21T17:02:23Z
tls.chain@104.20.23.154:443,2,not_after,2037-10-17T17:02:22Z
tls.chain@104.20.23.154:443,2,days_remaining,3997
tls.chain@104.20.23.154:443,2,key,ECDSA P-384 384
tls.chain@104.20.23.154:443,2,signature_algorithm,ecdsa-with-SHA384
tls.chain@104.20.23.154:443,2,fingerprint_sha256,5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92
tls.chain@104.20.23.154:443,2,fingerprint_sha1,E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8
tls.chain@104.20.23.154:443,2,serial,60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E
tls.chain@104.20.23.154:443,2,policy,OV
tls.chain@104.20.23.154:443,2,self_signed,false
tls.chain@104.20.23.154:443,2,expired,false
tls.chain@104.20.23.154:443,2,ca_issuers_url,http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
tls.chain@104.20.23.154:443,3,position,intermediate
tls.chain@104.20.23.154:443,3,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@104.20.23.154:443,3,issuer,"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"
tls.chain@104.20.23.154:443,3,not_before,2025-08-01T00:00:00Z
tls.chain@104.20.23.154:443,3,not_after,2028-12-31T23:59:59Z
tls.chain@104.20.23.154:443,3,days_remaining,786
tls.chain@104.20.23.154:443,3,key,ECDSA P-384 384
tls.chain@104.20.23.154:443,3,signature_algorithm,sha256WithRSAEncryption
tls.chain@104.20.23.154:443,3,fingerprint_sha256,BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8
tls.chain@104.20.23.154:443,3,fingerprint_sha1,5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC
tls.chain@104.20.23.154:443,3,serial,17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E
tls.chain@104.20.23.154:443,3,policy,EV
tls.chain@104.20.23.154:443,3,self_signed,false
tls.chain@104.20.23.154:443,3,expired,false
tls.chain@104.20.23.154:443,3,ocsp_url,http://ocsp.comodoca.com
tls.handshake@104.20.23.154:443,,version,TLSv1.3
tls.handshake@104.20.23.154:443,,cipher_suite,TLS13_AES_256_GCM_SHA384
tls.handshake@104.20.23.154:443,,key_exchange_group,X25519
tls.handshake@104.20.23.154:443,,sni,example.com
tls.handshake@104.20.23.154:443,,ocsp_stapled,true
tls.handshake@104.20.23.154:443,,ocsp_status,good
tls.handshake@104.20.23.154:443,,ocsp_this_update,2026-11-02T19:22:00Z
tls.handshake@104.20.23.154:443,,ocsp_next_update,2026-11-09T19:22:00Z
tls.handshake@104.20.23.154:443,,ocsp_live_status,good
tls.handshake@104.20.23.154:443,,ech,false
tls.handshake@104.20.23.154:443,,handshake_ms,6 ms
tls.probes@172.66.147.243:443,,ssl3,disabled
tls.probes@172.66.147.243:443,,ssl3_answer,alert handshake_failure
tls.probes@172.66.147.243:443,,tls1_0,enabled
tls.probes@172.66.147.243:443,,tls1_0_answer,server_hello TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
tls.probes@172.66.147.243:443,,tls1_1,enabled
tls.probes@172.66.147.243:443,,tls1_1_answer,server_hello TLSv1.1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
tls.probes@172.66.147.243:443,,tls1_2,enabled
tls.probes@172.66.147.243:443,,tls1_2_answer,server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
tls.probes@172.66.147.243:443,,tls1_3,enabled
tls.probes@172.66.147.243:443,,tls1_3_answer,handshake TLSv1.3
tls.probes@172.66.147.243:443,,suites_insecure,refused
tls.probes@172.66.147.243:443,,suites_insecure_answer,alert handshake_failure
tls.probes@172.66.147.243:443,,suites_cbc,accepted
tls.probes@172.66.147.243:443,,suites_cbc_answer,server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
tls.probes@172.66.147.243:443,,suites_static_rsa,accepted
tls.probes@172.66.147.243:443,,suites_static_rsa_answer,server_hello TLSv1.2 TLS_RSA_WITH_AES_128_GCM_SHA256
tls.protocols,,ssl3,disabled
tls.protocols,,tls1_0,enabled
tls.protocols,,tls1_1,enabled
tls.protocols,,tls1_2,enabled
tls.protocols,,tls1_3,enabled
tls.protocols,,suites_insecure,refused
tls.protocols,,suites_cbc,accepted
tls.protocols,,suites_static_rsa,accepted
tls.protocols,,forward_secrecy_all_suites,false
tls.ct,172.66.147.243,address,172.66.147.243
tls.ct,172.66.147.243,sct_count,2
tls.ct,172.66.147.243,log_ids,"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"
tls.ct,104.20.23.154,address,104.20.23.154
tls.ct,104.20.23.154,sct_count,2
tls.ct,104.20.23.154,log_ids,"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"
{"id":"gDO79E9Z","domain":"example.com","created_at":1793994940,"last_seen_at":1793994940,"predecessor_id":"CDVR1RYA","profile_version":5,"grade":"B","engine_version":"0.31.0","run":{"profile_version":5,"engine_version":"0.31.0","evidence_schema_version":1,"grade":"B","complete":true,"sections":[{"protocol":"dns","outcome":"measured","reason":null},{"protocol":"email","outcome":"measured","reason":null},{"protocol":"http","outcome":"measured","reason":null},{"protocol":"ip","outcome":"measured","reason":null},{"protocol":"tls","outcome":"measured","reason":null}],"checks":[{"id":"dns.caa","status":"warn","findings":["No CAA records found: any Certificate Authority can issue certificates for this domain; cf. RFC 8659"],"evidence":["dns.caa"]},{"id":"dns.cname_apex","status":"pass","evidence":["dns.cname","dns.soa"]},{"id":"dns.dnssec","status":"pass","evidence":["dns.dnskey","dns.ds","dns.nsec","dns.nsec3"]},{"id":"dns.dnskey_algorithm","status":"pass","evidence":["dns.dnskey"]},{"id":"dns.dnssec_rollover","status":"pass","evidence":["dns.dnskey","dns.ds"]},{"id":"dns.https_svcb","status":"pass","evidence":["dns.https","dns.svcb"]},{"id":"dns.ns","status":"pass","evidence":["dns.ns"]},{"id":"dns.ns_lame","status":"pass","evidence":["dns.ns"]},{"id":"dns.ns_delegation","status":"pass","evidence":["dns.ns"]},{"id":"dns.ttl","status":"pass","evidence":["dns.a","dns.aaaa","dns.mx","dns.caa","dns.ns","dns.https","dns.cname","dns.dnskey","dns.ds","dns.nsec","dns.nsec3","dns.soa","dns.svcb","dns.txt"]},{"id":"email.mx","status":"not_applicable","findings":["Null MX"]},{"id":"email.spf","status":"pass","findings":["domain declares it sends no mail (Null MX or SPF -all only)"],"evidence":["email.spf","email.mx"]},{"id":"email.dkim","status":"not_applicable","findings":["only revoked DKIM keys"]},{"id":"email.dmarc","status":"warn","findings":["no aggregate reports"],"evidence":["email.dmarc"]},{"id":"email.mta_sts","status":"not_applicable","findings":["Null MX"]},{"id":"email.tls_rpt","status":"not_applicable","findings":["Null MX"]},{"id":"email.bimi","status":"not_applicable","findings":["Null MX"]},{"id":"email.dane","status":"not_applicable","findings":["Null MX"]},{"id":"email.dnsbl","status":"not_applicable","findings":["Null MX"]},{"id":"email.fcrdns","status":"not_applicable","findings":["Null MX"]},{"id":"http.https_redirect","status":"fail","findings":["HTTP port 80 does not redirect to HTTPS"],"evidence":["http.port80","http.port80_probe"]},{"id":"http.hsts","status":"fail","findings":["No HSTS header found"],"evidence":["http.headers"]},{"id":"http.cors","status":"pass","evidence":["http.cors"]},{"id":"http.cookie_secure","status":"not_applicable","findings":["not applicable"],"evidence":["http.cookies"]},{"id":"http.csp","status":"warn","findings":["No Content-Security-Policy header"],"evidence":["http.headers"]},{"id":"http.x_frame_options","status":"warn","findings":["Missing x-frame-options header"],"evidence":["http.headers"]},{"id":"http.x_content_type_options","status":"warn","findings":["Missing x-content-type-options header"],"evidence":["http.headers"]},{"id":"http.referrer_policy","status":"warn","findings":["Missing referrer-policy header"],"evidence":["http.headers"]},{"id":"http.permissions_policy","status":"warn","findings":["Missing permissions-policy header"],"evidence":["http.headers"]},{"id":"http.coop","status":"warn","findings":["Missing cross-origin-opener-policy header"],"evidence":["http.headers","http.isolation"]},{"id":"http.deprecated_headers","status":"pass","evidence":["http.headers"]},{"id":"http.info_leakage","status":"warn","findings":["Info leakage headers: Server"],"evidence":["http.headers"]},{"id":"http.caching","status":"warn","findings":["No Cache-Control header"],"evidence":["http.headers","http.caching"]},{"id":"ip.reputation","status":"pass","evidence":["ip.addresses"]},{"id":"tls.tls_reachable","status":"pass","evidence":["tls.addresses"]},{"id":"tls.chain_trusted","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.not_expired","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.hostname_match","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.chain_complete","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.strong_signature","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.key_strength","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.expiry_window","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.cert_lifetime","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.san_quality","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.aia_reachability","status":"not_applicable","findings":["Chain is complete; AIA URLs not required for verification"],"evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.tls_version","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.forward_secrecy","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.aead_cipher","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.legacy_versions","status":"fail","findings":["172.66.147.243: accepts TLS 1.0, TLS 1.1"],"evidence":["tls.probes@172.66.147.243:443","tls.protocols"]},{"id":"tls.weak_suites","status":"warn","findings":["172.66.147.243: accepts CBC suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","172.66.147.243: accepts static RSA suite TLS_RSA_WITH_AES_128_GCM_SHA256"],"evidence":["tls.probes@172.66.147.243:443","tls.protocols"]},{"id":"tls.ct_logged","status":"pass","evidence":["tls.ct"]},{"id":"tls.ocsp_stapled","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.caa_compliant","status":"pass","evidence":["tls.caa"]},{"id":"tls.dane_valid","status":"not_applicable","findings":["DANE check skipped (requires DNSSEC)"],"evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.consistency","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443","tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.alpn_consistency","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.ech_advertised","status":"warn","findings":["172.66.147.243: ECH not advertised in HTTPS DNS record","104.20.23.154: ECH not advertised in HTTPS DNS record"],"evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443","dns.https"]}],"blocks":[{"id":"dns.a","title":"A","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"A"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"104.20.23.154"}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"A"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"172.66.147.243"}}]}},{"id":"dns.aaaa","title":"AAAA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"AAAA"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"2606:4700:10::6814:179a"}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"AAAA"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"2606:4700:10::ac42:93f3"}}]}},{"id":"dns.mx","title":"MX","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"MX"},"ttl":{"t":"int","v":196},"data":{"t":"text","v":"0 ."}}]}},{"id":"dns.caa","title":"CAA","shape":{"kind":"records","data":[]}},{"id":"dns.ns","title":"NS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":21600},"data":{"t":"text","v":"elliott.ns.cloudflare.com."}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":21600},"data":{"t":"text","v":"hera.ns.cloudflare.com."}}]}},{"id":"dns.https","title":"HTTPS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"HTTPS"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"1 . alpn=h3,h2 ipv4hint=104.20.23.154,172.66.147.243 ipv6hint=2606:4700:10::6814:179a,2606:4700:10::ac42:93f3"}}]}},{"id":"dns.cname","title":"CNAME","shape":{"kind":"records","data":[]}},{"id":"dns.dnskey","title":"DNSKEY","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"256 3 13 MjyZielP0GqniI1+j+wAG/3t0ImDDIlj1CxR0oobkZQHSKH2Fqx6tm2NcYu57POJ83SzCWLkqIjZHS1mh5wbaw=="}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"256 3 13 kxipjoIbNZDsWqEKaYaGq6fM/XThrRp1ue6AV9R/n3eWxpGCeCWJb47PEEEj/Q6VAYFW/7UFo5mXoZfxKYZa3A=="}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA=="}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="}}]}},{"id":"dns.ds","title":"DS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DS"},"ttl":{"t":"int","v":15912},"data":{"t":"text","v":"2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A"}}]}},{"id":"dns.nsec","title":"NSEC","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"NSEC"},"ttl":{"t":"int","v":1800},"data":{"t":"text","v":"\\000.example.com. A NS SOA PTR HINFO MX TXT AAAA Unknown SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA Unknown CDS CDNSKEY OPENPGPKEY SVCB HTTPS Unknown CAA"}}]}},{"id":"dns.nsec3","title":"NSEC3","shape":{"kind":"records","data":[]}},{"id":"dns.soa","title":"SOA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"SOA"},"ttl":{"t":"int","v":581},"data":{"t":"text","v":"elliott.ns.cloudflare.com. dns.cloudflare.com. 2418004112 10000 2400 604800 1800"}}]}},{"id":"dns.svcb","title":"SVCB","shape":{"kind":"records","data":[]}},{"id":"dns.txt","title":"TXT","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"TXT"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"\"_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9\""}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"TXT"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"\"v=spf1 -all\""}}]}},{"id":"email.mx","title":"MX","shape":{"kind":"table","data":{"key":"host","columns":["host","preference"],"rows":[[{"t":"text","v":"."},{"t":"int","v":0}]]}}},{"id":"email.mx_addresses","title":"MX addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","host"],"rows":[]}}},{"id":"email.spf","title":"SPF","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=spf1 -all"}],["lookup_count",{"t":"int","v":0}],["void_lookups",{"t":"int","v":0}]]}},{"id":"email.dmarc","title":"DMARC","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"}],["p",{"t":"text","v":"reject"}],["sp",{"t":"text","v":"reject"}],["adkim",{"t":"text","v":"s"}],["aspf",{"t":"text","v":"s"}]]}},{"id":"email.mta_sts","title":"MTA-STS","shape":{"kind":"fields","data":[]}},{"id":"email.tls_rpt","title":"TLS-RPT","shape":{"kind":"fields","data":[]}},{"id":"email.bimi","title":"BIMI","shape":{"kind":"fields","data":[]}},{"id":"email.dnssec","title":"DNSSEC","shape":{"kind":"fields","data":[["dnskey_present",{"t":"bool","v":true}]]}},{"id":"email.dkim","title":"DKIM keys","shape":{"kind":"table","data":{"key":"key","columns":["key","selector","state","key_type","bits"],"rows":[[{"t":"text","v":"default#1"},{"t":"text","v":"default"},{"t":"text","v":"revoked"},{"t":"text","v":""},{"t":"text","v":""}]]}}},{"id":"email.summary","title":"Summary","shape":{"kind":"fields","data":[["grade",{"t":"text","v":"B"}]]}},{"id":"http.redirects","title":"Redirects","shape":{"kind":"chain","data":[]}},{"id":"http.port80","title":"Port 80 redirects","shape":{"kind":"chain","data":[]}},{"id":"http.port80_probe","title":"Port 80 probe","shape":{"kind":"fields","data":[["url",{"t":"text","v":"http://example.com/"}],["status_code",{"t":"int","v":200}],["redirects_to_https",{"t":"bool","v":false}]]}},{"id":"http.headers","title":"Response headers","shape":{"kind":"table","data":{"key":"name","columns":["name","value"],"rows":[[{"t":"text","v":"date"},{"t":"text","v":"Fri, 06 Nov 2026 19:55:40 GMT"}],[{"t":"text","v":"content-type"},{"t":"text","v":"text/html; charset=utf-8"}],[{"t":"text","v":"server"},{"t":"text","v":"cloudflare"}],[{"t":"text","v":"last-modified"},{"t":"text","v":"Thu, 05 Nov 2026 21:17:41 GMT"}],[{"t":"text","v":"allow"},{"t":"text","v":"GET, HEAD"}],[{"t":"text","v":"age"},{"t":"text","v":"5"}],[{"t":"text","v":"cf-cache-status"},{"t":"text","v":"HIT"}],[{"t":"text","v":"content-encoding"},{"t":"text","v":"br"}],[{"t":"text","v":"cf-ray"},{"t":"text","v":"a566a838cea43727-FRA"}],[{"t":"text","v":"alt-svc"},{"t":"text","v":"h3=\":443\"; ma=86400"}]]}}},{"id":"http.caching","title":"Caching","shape":{"kind":"fields","data":[["last_modified",{"t":"time","v":"2026-11-05T21:17:41Z"}],["age",{"t":"int","v":5}]]}},{"id":"http.cdn","title":"CDN","shape":{"kind":"fields","data":[["provider",{"t":"text","v":"Cloudflare"}],["cache_status",{"t":"text","v":"HIT"}],["indicator",{"t":"text","v":"cf-ray"}],["indicator",{"t":"text","v":"cf-cache-status"}]]}},{"id":"http.isolation","title":"Cross-origin isolation","shape":{"kind":"fields","data":[["missing",{"t":"text","v":"cross-origin-opener-policy"}],["missing",{"t":"text","v":"cross-origin-embedder-policy"}],["missing",{"t":"text","v":"cross-origin-resource-policy"}]]}},{"id":"http.server","title":"Server","shape":{"kind":"fields","data":[["final_url",{"t":"text","v":"https://example.com/"}],["status_code",{"t":"int","v":200}],["http_version",{"t":"text","v":"h2"}],["inspection_ms",{"t":"duration","v":403}],["address",{"t":"addr","v":"172.66.147.243"}],["org",{"t":"text","v":"Cloudflare, Inc."}],["network_type",{"t":"text","v":"cloud"}]]}},{"id":"http.cors","title":"CORS","shape":{"kind":"fields","data":[["allows_any_origin",{"t":"bool","v":false}],["reflects_origin",{"t":"bool","v":false}],["allows_credentials",{"t":"bool","v":false}]]}},{"id":"http.cookies","title":"Cookies","shape":{"kind":"table","data":{"key":"cookie","columns":["cookie","name","secure","http_only","same_site"],"rows":[]}}},{"id":"ip.addresses","title":"Addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","asn","org","prefix","network_type","country","city","spamhaus","c2","tor","vpn"],"rows":[[{"t":"addr","v":"104.20.23.154"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"104.20.0.0/18"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"172.66.147.243"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"172.66.128.0/19"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"2606:4700:10::6814:179a"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"2606:4700::/43"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"2606:4700:10::ac42:93f3"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"2606:4700::/43"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}]]}}},{"id":"tls.addresses","title":"Addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","port","outcome","message"],"rows":[[{"t":"addr","v":"172.66.147.243"},{"t":"int","v":443},{"t":"text","v":"ok"},{"t":"text","v":""}],[{"t":"addr","v":"2606:4700:10::ac42:93f3"},{"t":"int","v":443},{"t":"text","v":"NOT_TESTED_FROM_HERE"},{"t":"text","v":"Network unreachable (os error 101)"}],[{"t":"addr","v":"104.20.23.154"},{"t":"int","v":443},{"t":"text","v":"ok"},{"t":"text","v":""}]]}}},{"id":"tls.chain@172.66.147.243:443","title":"Certificate chain 172.66.147.243:443","shape":{"kind":"chain","data":[[["position",{"t":"text","v":"leaf"}],["subject",{"t":"text","v":"CN=example.com"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["sans",{"t":"text","v":"example.com"}],["sans",{"t":"text","v":"*.example.com"}],["not_before",{"t":"time","v":"2026-09-26T22:49:11Z"}],["not_after",{"t":"time","v":"2026-12-25T22:56:35Z"}],["days_remaining",{"t":"int","v":49}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA256"}],["fingerprint_sha256",{"t":"text","v":"85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A"}],["fingerprint_sha1",{"t":"text","v":"89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D"}],["serial",{"t":"text","v":"01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90"}],["policy",{"t":"text","v":"DV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://o.cf-i.ssl.com"}],["ca_issuers_url",{"t":"text","v":"http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["not_before",{"t":"time","v":"2025-05-29T19:49:45Z"}],["not_after",{"t":"time","v":"2035-05-27T19:49:44Z"}],["days_remaining",{"t":"int","v":3123}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26"}],["fingerprint_sha1",{"t":"text","v":"AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08"}],["serial",{"t":"text","v":"31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["not_before",{"t":"time","v":"2022-10-21T17:02:23Z"}],["not_after",{"t":"time","v":"2037-10-17T17:02:22Z"}],["days_remaining",{"t":"int","v":3997}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92"}],["fingerprint_sha1",{"t":"text","v":"E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8"}],["serial",{"t":"text","v":"60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["issuer",{"t":"text","v":"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"}],["not_before",{"t":"time","v":"2025-08-01T00:00:00Z"}],["not_after",{"t":"time","v":"2028-12-31T23:59:59Z"}],["days_remaining",{"t":"int","v":786}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8"}],["fingerprint_sha1",{"t":"text","v":"5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC"}],["serial",{"t":"text","v":"17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E"}],["policy",{"t":"text","v":"EV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://ocsp.comodoca.com"}]]]}},{"id":"tls.handshake@172.66.147.243:443","title":"Handshake 172.66.147.243:443","shape":{"kind":"fields","data":[["version",{"t":"text","v":"TLSv1.3"}],["cipher_suite",{"t":"text","v":"TLS13_AES_256_GCM_SHA384"}],["key_exchange_group",{"t":"text","v":"X25519"}],["sni",{"t":"text","v":"example.com"}],["ocsp_stapled",{"t":"bool","v":true}],["ocsp_status",{"t":"text","v":"good"}],["ocsp_this_update",{"t":"time","v":"2026-11-02T19:22:00Z"}],["ocsp_next_update",{"t":"time","v":"2026-11-09T19:22:00Z"}],["ocsp_live_status",{"t":"text","v":"good"}],["ech",{"t":"bool","v":false}],["handshake_ms",{"t":"duration","v":21}]]}},{"id":"tls.chain@104.20.23.154:443","title":"Certificate chain 104.20.23.154:443","shape":{"kind":"chain","data":[[["position",{"t":"text","v":"leaf"}],["subject",{"t":"text","v":"CN=example.com"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["sans",{"t":"text","v":"example.com"}],["sans",{"t":"text","v":"*.example.com"}],["not_before",{"t":"time","v":"2026-09-26T22:49:11Z"}],["not_after",{"t":"time","v":"2026-12-25T22:56:35Z"}],["days_remaining",{"t":"int","v":49}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA256"}],["fingerprint_sha256",{"t":"text","v":"85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A"}],["fingerprint_sha1",{"t":"text","v":"89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D"}],["serial",{"t":"text","v":"01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90"}],["policy",{"t":"text","v":"DV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://o.cf-i.ssl.com"}],["ca_issuers_url",{"t":"text","v":"http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["not_before",{"t":"time","v":"2025-05-29T19:49:45Z"}],["not_after",{"t":"time","v":"2035-05-27T19:49:44Z"}],["days_remaining",{"t":"int","v":3123}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26"}],["fingerprint_sha1",{"t":"text","v":"AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08"}],["serial",{"t":"text","v":"31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["not_before",{"t":"time","v":"2022-10-21T17:02:23Z"}],["not_after",{"t":"time","v":"2037-10-17T17:02:22Z"}],["days_remaining",{"t":"int","v":3997}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92"}],["fingerprint_sha1",{"t":"text","v":"E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8"}],["serial",{"t":"text","v":"60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["issuer",{"t":"text","v":"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"}],["not_before",{"t":"time","v":"2025-08-01T00:00:00Z"}],["not_after",{"t":"time","v":"2028-12-31T23:59:59Z"}],["days_remaining",{"t":"int","v":786}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8"}],["fingerprint_sha1",{"t":"text","v":"5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC"}],["serial",{"t":"text","v":"17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E"}],["policy",{"t":"text","v":"EV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://ocsp.comodoca.com"}]]]}},{"id":"tls.handshake@104.20.23.154:443","title":"Handshake 104.20.23.154:443","shape":{"kind":"fields","data":[["version",{"t":"text","v":"TLSv1.3"}],["cipher_suite",{"t":"text","v":"TLS13_AES_256_GCM_SHA384"}],["key_exchange_group",{"t":"text","v":"X25519"}],["sni",{"t":"text","v":"example.com"}],["ocsp_stapled",{"t":"bool","v":true}],["ocsp_status",{"t":"text","v":"good"}],["ocsp_this_update",{"t":"time","v":"2026-11-02T19:22:00Z"}],["ocsp_next_update",{"t":"time","v":"2026-11-09T19:22:00Z"}],["ocsp_live_status",{"t":"text","v":"good"}],["ech",{"t":"bool","v":false}],["handshake_ms",{"t":"duration","v":6}]]}},{"id":"tls.probes@172.66.147.243:443","title":"Protocol probes 172.66.147.243:443","shape":{"kind":"fields","data":[["ssl3",{"t":"text","v":"disabled"}],["ssl3_answer",{"t":"text","v":"alert handshake_failure"}],["tls1_0",{"t":"text","v":"enabled"}],["tls1_0_answer",{"t":"text","v":"server_hello TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}],["tls1_1",{"t":"text","v":"enabled"}],["tls1_1_answer",{"t":"text","v":"server_hello TLSv1.1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}],["tls1_2",{"t":"text","v":"enabled"}],["tls1_2_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}],["tls1_3",{"t":"text","v":"enabled"}],["tls1_3_answer",{"t":"text","v":"handshake TLSv1.3"}],["suites_insecure",{"t":"text","v":"refused"}],["suites_insecure_answer",{"t":"text","v":"alert handshake_failure"}],["suites_cbc",{"t":"text","v":"accepted"}],["suites_cbc_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"}],["suites_static_rsa",{"t":"text","v":"accepted"}],["suites_static_rsa_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_RSA_WITH_AES_128_GCM_SHA256"}]]}},{"id":"tls.protocols","title":"Protocols and features","shape":{"kind":"fields","data":[["ssl3",{"t":"text","v":"disabled"}],["tls1_0",{"t":"text","v":"enabled"}],["tls1_1",{"t":"text","v":"enabled"}],["tls1_2",{"t":"text","v":"enabled"}],["tls1_3",{"t":"text","v":"enabled"}],["suites_insecure",{"t":"text","v":"refused"}],["suites_cbc",{"t":"text","v":"accepted"}],["suites_static_rsa",{"t":"text","v":"accepted"}],["forward_secrecy_all_suites",{"t":"bool","v":false}]]}},{"id":"tls.ct","title":"Certificate Transparency","shape":{"kind":"table","data":{"key":"address","columns":["address","sct_count","log_ids"],"rows":[[{"t":"addr","v":"172.66.147.243"},{"t":"int","v":2},{"t":"text","v":"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"}],[{"t":"addr","v":"104.20.23.154"},{"t":"int","v":2},{"t":"text","v":"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"}]]}}},{"id":"tls.caa","title":"CAA","shape":{"kind":"records","data":[]}}]}}
run of 2026-11-06 19:55 UTC entry gDO79E9Z
pass
TLS·12
Chain trusted
pass
TLS·13
Certificate valid
pass
TLS·14
Hostname match
pass
TLS·15
Chain complete
pass
TLS·16
Strong signature
pass
TLS·17
Key strength
pass
TLS·18
Expiry window
pass
TLS·19
Certificate lifetime
pass
TLS·20
SAN quality
untested
TLS·21
AIA reachable
Chain is complete; AIA URLs not required for verification
pass
TLS·22
TLS version
pass
TLS·23
Forward secrecy
pass
TLS·24
AEAD cipher
fail
TLS·25
Legacy protocol versions
172.66.147.243: accepts TLS 1.0, TLS 1.1
Fix: Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3.
warn
TLS·26
Weak cipher suites
172.66.147.243: accepts CBC suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA; 172.66.147.243: accepts static RSA suite TLS_RSA_WITH_AES_128_GCM_SHA256
Fix: Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites.
pass
TLS·27
OCSP stapling
pass
TLS·28
CT logged
pass
TLS·29
CAA compliant
untested
TLS·30
DANE valid
DANE check skipped (requires DNSSEC)
pass
TLS·31
Multi-IP consistency
pass
TLS·32
ALPN consistency
warn
TLS·33
ECH advertised
172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record
Fix: Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server.
Addresses
| Address | Band | Protocol | Cipher | Leaf |
|---|---|---|---|---|
| 172.66.147.243 | TLSv1.3 | TLS13_AES_256_GCM_SHA384 | SHA256 85:ca:…:7a same | |
| 2606:4700:10::ac42:93f3 | NOT_TESTED_FROM_HERE Network unreachable (os error 101) | |||
| 104.20.23.154 | TLSv1.3 | TLS13_AES_256_GCM_SHA384 | SHA256 85:ca:…:7a same | |
Port 443 · handshake 21 ms (172.66.147.243) · 6 ms (104.20.23.154)
Feeds lines: Reach
Certificate
not before 2026-09-26today · 49 days leftnot after 2026-12-25
the last 30 days turn the expiry line amber
SubjectCN=example.com
Alternative namesexample.com, *.example.com
IssuerC=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3
KeyECDSA P-256 256
Signatureecdsa-with-SHA256
OCSPstapled · good · 2026-11-02, fresh until 2026-11-09 live: good
Certificate Transparency2 SCTs
Serial01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90
SHA-25685:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A
SHA-189:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D
PolicyDV
OCSP responderhttp://o.cf-i.ssl.com
CA issuershttp://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
SCT logs944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7
Chain
Chain certificates
Cloudflare TLS Issuing ECC CA 3
SubjectC=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3
IssuerC=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2
Not before2025-05-29
Not after2035-05-27
Days left3123 days
KeyECDSA P-256 256
Signatureecdsa-with-SHA384
Serial31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27
SHA-256F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26
SHA-1AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08
PolicyOV
CA issuershttp://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
SSL.com TLS Transit ECC CA R2
SubjectC=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2
IssuerC=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022
Not before2022-10-21
Not after2037-10-17
Days left3997 days
KeyECDSA P-384 384
Signatureecdsa-with-SHA384
Serial60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E
SHA-2565D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92
SHA-1E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8
PolicyOV
CA issuershttp://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
SSL.com TLS ECC Root CA 2022
SubjectC=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022
IssuerC=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
Not before2025-08-01
Not after2028-12-31
Days left786 days
KeyECDSA P-384 384
Signaturesha256WithRSAEncryption
Serial17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E
SHA-256BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8
SHA-15C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC
PolicyEV
OCSP responderhttp://ocsp.comodoca.com
Protocols and features
TLS 1.3enabled
TLS 1.2enabled
TLS 1.1enabled
TLS 1.0enabled
ALPNnone
Forward secrecynot all suites
Encrypted Client Hellonot advertised
SSL 3.0disabled
Cipher suitesinsecure refused · CBC accepted · static RSA accepted
Key exchangeX25519
SNIexample.com
Probe answers
| Probe | 172.66.147.243 |
|---|---|
| SSL 3.0 | disabled alert handshake_failure |
| TLS 1.0 | enabled server_hello TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
| TLS 1.1 | enabled server_hello TLSv1.1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
| TLS 1.2 | enabled server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
| TLS 1.3 | enabled handshake TLSv1.3 |
| insecure suites | refused alert handshake_failure |
| CBC suites | accepted server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
| static RSA suites | accepted server_hello TLSv1.2 TLS_RSA_WITH_AES_128_GCM_SHA256 |
CAA
Nothing recorded.
Feeds lines: CAA ok