Ticket #3065: testssl-result.xhtml

File testssl-result.xhtml, 13.4 KB (added by Jay-C, 9 years ago)

Test results from testssl.sh. Redacted for privacy.

Line 
1<?xml version="1.0" encoding="UTF-8" ?>
2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><!-- This file was created with the aha Ansi HTML Adapter. http://ziz.delphigl.com/tool_aha.php -->
3<html xmlns="http://www.w3.org/1999/xhtml">
4 <head>
5 <meta http-equiv="content-type" content="application/xhtml+xml; charset=UTF-8" />
6 <title>stdin</title>
7 </head>
8 <body>
9 <pre><span style="font-weight:bold;">
10###########################################################
11 testssl.sh 2.8 from https://testssl.sh/
12 (</span><span style="color:black;font-weight:bold;">1.582 2017/05/10 19:04:47</span><span
13style="font-weight:bold;">)
14
15 This program is free software. Distribution and
16 modification under GPLv2 permitted.
17 USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
18
19 Please file bugs @ https://testssl.sh/bugs/
20
21###########################################################</span>
22
23 Using "OpenSSL 1.0.2-chacha (1.0.2i-dev)" [~183 ciphers]
24 on &lt;snip&gt;:&lt;snip&gt;testssl.sh/bin/openssl.Linux.x86_64
25 (built: "Jun 22 19:32:29 2016", platform: "linux-x86_64")
26
27
28<span style="color:gray;background-color:black;"> Start 2017-06-23 07:33:40 --&gt;&gt; &lt;snip&gt; &lt;&lt;--</span>
29
30 rDNS (&lt;snip&gt;): --
31 Service detected: HTTP
32
33
34<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing protocols </span><span
35style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;">(via sockets except TLS 1.2, SPDY+HTTP2) </span>
36
37<span style="font-weight:bold;"> SSLv2 </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
38<span style="font-weight:bold;"> SSLv3 </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
39<span style="font-weight:bold;"> TLS 1 </span>offered
40<span style="font-weight:bold;"> TLS 1.1 </span>offered
41<span style="font-weight:bold;"> TLS 1.2 </span><span style="color:green;font-weight:bold;">offered (OK)</span>
42<span style="font-weight:bold;"> Version tolerance </span><span style="color:green;font-weight:bold;">downgraded to TLSv1.2 (OK)</span>
43<span style="font-weight:bold;"> SPDY/NPN </span>not offered
44<span style="font-weight:bold;"> HTTP2/ALPN </span>not offered
45
46<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing ~standard cipher lists </span>
47
48<span style="font-weight:bold;"> Null Ciphers </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
49<span style="font-weight:bold;"> Anonymous NULL Ciphers </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
50<span style="font-weight:bold;"> Anonymous DH Ciphers </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
51<span style="font-weight:bold;"> 40 Bit encryption </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
52<span style="font-weight:bold;"> 56 Bit export ciphers </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
53<span style="font-weight:bold;"> Export Ciphers (general) </span><span style="color:green;font-weight:bold;">not offered (OK)</span>
54<span style="font-weight:bold;"> Low (&lt;=64 Bit) </span><span style="color:red;font-weight:bold;">offered (NOT ok)</span>
55<span style="font-weight:bold;"> DES Ciphers </span><span style="color:red;font-weight:bold;">offered (NOT ok)</span>
56<span style="font-weight:bold;"> "Medium" grade encryption </span><span style="color:red;">offered (NOT ok)</span>
57<span style="font-weight:bold;"> Triple DES Ciphers </span><span style="color:olive;">offered</span>
58<span style="font-weight:bold;"> High grade encryption </span><span style="color:green;font-weight:bold;">offered (OK)</span>
59
60
61<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption, 3DES, RC4 </span>
62
63<span style="color:olive;"> No ciphers supporting Forward Secrecy offered</span>
64
65
66<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing server preferences </span>
67
68<span style="font-weight:bold;"> Has server cipher order? </span><span style="color:red;">nope (NOT ok)</span>
69<span style="font-weight:bold;"> Negotiated protocol </span><span style="color:green;font-weight:bold;">TLSv1.2</span>
70<span style="font-weight:bold;"> Negotiated cipher </span><span style="color:green;font-weight:bold;">AES256-GCM-SHA384</span> (limited sense as client will pick)
71<span style="font-weight:bold;"> Negotiated cipher per proto</span> (limited sense as client will pick)
72 AES256-SHA: TLSv1, TLSv1.1
73 AES256-GCM-SHA384: TLSv1.2
74 No further cipher order check has been done as order is determined by the client
75
76
77<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing HTTP header response @ "/" </span>
78
79<span style="font-weight:bold;"> HTTP Status Code </span> 200 OK
80<span style="font-weight:bold;"> HTTP clock skew </span>0 sec from localtime
81<span style="font-weight:bold;"> Strict Transport Security </span>--
82<span style="font-weight:bold;"> Public Key Pinning </span>--
83<span style="font-weight:bold;"> Server banner </span>TwistedWeb/<span
84style="color:olive;">1</span><span style="color:olive;">3</span>.<span style="color:olive;">2</span>.<span
85style="color:olive;">0</span>
86<span style="font-weight:bold;"> Application banner </span>--
87<span style="font-weight:bold;"> Cookie(s) </span>(none issued at "/")
88<span style="font-weight:bold;"> Security headers </span><span style="color:olive;">--</span>
89<span style="font-weight:bold;"> Reverse Proxy banner </span>--
90
91
92<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing vulnerabilities </span>
93
94<span style="font-weight:bold;"> Heartbleed</span> (CVE-2014-0160) <span
95style="color:green;font-weight:bold;">not vulnerable (OK)</span>, timed out
96<span style="font-weight:bold;"> CCS</span> (CVE-2014-0224) <span
97style="color:green;font-weight:bold;">not vulnerable (OK)</span>
98<span style="font-weight:bold;"> Secure Renegotiation </span>(CVE-2009-3555) <span
99style="color:green;font-weight:bold;">not vulnerable (OK)</span>
100<span style="font-weight:bold;"> Secure Client-Initiated Renegotiation </span><span
101style="color:red;">VULNERABLE (NOT ok)</span>, DoS threat
102<span style="font-weight:bold;"> CRIME, TLS </span>(CVE-2012-4929) <span
103style="color:green;">not vulnerable (OK)</span>
104<span style="font-weight:bold;"> BREACH</span> (CVE-2013-3587) <span
105style="color:green;font-weight:bold;">no HTTP compression (OK) </span> - only supplied "/" tested
106<span style="font-weight:bold;"> POODLE, SSL</span> (CVE-2014-3566) <span
107style="color:green;font-weight:bold;">not vulnerable (OK)</span>
108<span style="font-weight:bold;"> TLS_FALLBACK_SCSV</span> (RFC 7507), <span
109style="color:green;">Downgrade attack prevention supported (OK)</span>
110<span style="font-weight:bold;"> FREAK</span> (CVE-2015-0204) <span
111style="color:green;font-weight:bold;">not vulnerable (OK)</span>
112<span style="font-weight:bold;"> DROWN</span> (2016-0800, CVE-2016-0703) <span
113style="color:green;font-weight:bold;">not vulnerable on this port (OK)</span>
114 make sure you don't use this certificate elsewhere with SSLv2 enabled services
115<span style="font-weight:bold;"> LOGJAM</span> (CVE-2015-4000), experimental <span
116style="color:green;font-weight:bold;">not vulnerable (OK)</span>, common primes not checked. See below for any DH ciphers + bit size
117<span style="font-weight:bold;"> BEAST</span> (CVE-2011-3389) TLS1:<span
118style="color:olive;font-weight:bold;"> DES-CBC-SHA DES-CBC3-SHA
119 AES128-SHA AES256-SHA CAMELLIA128-SHA
120 CAMELLIA256-SHA SEED-SHA</span>
121 <span style="color:olive;font-weight:bold;">VULNERABLE</span> -- but also supports higher protocols (possible mitigation): TLSv1.1 TLSv1.2
122<span style="font-weight:bold;"> RC4</span> (CVE-2013-2566, CVE-2015-2808) <span
123style="color:red;">VULNERABLE (NOT ok): </span><span style="color:red;">RC4-SHA </span><span
124style="color:red;">RC4-MD5 </span>
125
126
127<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Testing all 183 locally available ciphers against the server, ordered by encryption strength </span>
128
129Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (RFC)
130---------------------------------------------------------------------------------------------------------------------------
131 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
132 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
133 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
134 x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
135 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
136 x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
137 x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
138 x96 SEED-SHA RSA SEED 128 TLS_RSA_WITH_SEED_CBC_SHA
139 x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
140 x05 RC4-SHA RSA RC4 128 TLS_RSA_WITH_RC4_128_SHA
141 x04 RC4-MD5 RSA RC4 128 TLS_RSA_WITH_RC4_128_MD5
142 x0a DES-CBC3-SHA RSA 3DES 168 TLS_RSA_WITH_3DES_EDE_CBC_SHA
143 x09 DES-CBC-SHA RSA DES 56 TLS_RSA_WITH_DES_CBC_SHA
144
145
146<span style="font-weight:bold;"></span><span style="text-decoration:underline;font-weight:bold;"> Running browser simulations via sockets (experimental) </span>
147
148 Android 2.3.7 TLSv1.0 RC4-MD5
149 Android 4.1.1 TLSv1.0 AES256-SHA
150 Android 4.2.2 TLSv1.0 AES256-SHA
151 Android 4.4.2 TLSv1.2 AES256-GCM-SHA384
152 Android 5.0.0 TLSv1.2 AES256-SHA
153 Android 6.0 TLSv1.2 AES128-GCM-SHA256
154 Android 7.0 TLSv1.2 AES128-GCM-SHA256
155 Baidu Jan 2015 TLSv1.0 CAMELLIA256-SHA
156 BingPreview Jan 2015 TLSv1.2 AES256-GCM-SHA384
157 Chrome 48 OS X TLSv1.2 AES128-GCM-SHA256
158 Chrome 51 Win 7 TLSv1.2 AES128-GCM-SHA256
159 Edge 13 Win 10 TLSv1.2 AES256-GCM-SHA384
160 Edge 13 Win Phone 10 TLSv1.2 AES256-GCM-SHA384
161 Firefox 45 Win 7 TLSv1.2 AES128-SHA
162 Firefox 49 Win 7 TLSv1.2 AES128-SHA
163 Firefox 49 XP SP3 TLSv1.2 AES128-SHA
164 Googlebot Feb 2015 TLSv1.2 AES128-GCM-SHA256
165 IE 11 Win 10 TLSv1.2 AES256-GCM-SHA384
166 IE 11 Win 7 TLSv1.2 AES256-GCM-SHA384
167 IE 11 Win 8.1 TLSv1.2 AES256-GCM-SHA384
168 IE 11 Win Phone 8.1 TLSv1.2 AES128-SHA256
169 IE 11 Win Phone 8.1 Update TLSv1.2 AES256-GCM-SHA384
170 IE 6 XP No connection
171 IE 7 Vista TLSv1.0 AES128-SHA
172 IE 8 Win 7 TLSv1.0 AES128-SHA
173 IE 8 XP TLSv1.0 RC4-MD5
174 Java 6u45 TLSv1.0 RC4-MD5
175 Java 7u25 TLSv1.0 AES128-SHA
176 Java 8b132 TLSv1.2 AES128-SHA256
177 OpenSSL 1.0.1l TLSv1.2 AES256-GCM-SHA384
178 OpenSSL 1.0.2e TLSv1.2 AES256-GCM-SHA384
179 Opera 17 Win 7 TLSv1.2 AES256-SHA
180 Safari 5.1.9 OS X 10.6.8 TLSv1.0 AES128-SHA
181 Safari 6.0.4 OS X 10.8.4 TLSv1.0 AES128-SHA
182 Safari 7 OS X 10.9 TLSv1.2 AES256-SHA256
183 Safari 8 OS X 10.10 TLSv1.2 AES256-SHA256
184 Safari 9 iOS 9 TLSv1.2 AES256-GCM-SHA384
185 Safari 9 OS X 10.11 TLSv1.2 AES256-GCM-SHA384
186 Safari 10 OS X 10.12 TLSv1.2 AES256-GCM-SHA384
187 Apple ATS 9 iOS 9 No connection
188 Tor 17.0.9 Win 7 TLSv1.0 CAMELLIA256-SHA
189 Yahoo Slurp Jan 2015 TLSv1.2 AES256-GCM-SHA384
190 YandexBot Jan 2015 TLSv1.2 AES256-GCM-SHA384
191
192<span style="color:gray;background-color:black;"> Done 2017-06-23 07:34:23 --&gt;&gt; &lt;snip&gt; &lt;&lt;--</span>
193
194
195</pre>
196 </body>
197</html>