Various reports of all servers tested
Report for december 2013 |
Results of the last day |
Results of the last week |
Results of the last month
TLS versions 44 results
| SSL 2 |
0 0% |
| SSL 3 |
0 0% |
| TLS 1.0 |
23 52.3% |
| TLS 1.1 |
23 52.3% |
| TLS 1.2 |
44 100% |
Grades 44 results
| A |
39 88.6% |
| B |
5 11.4% |
| C |
0 0% |
| D |
0 0% |
| E |
0 0% |
| F |
0 0% |
Does not penalize untrusted certificates.
RSA key sizes for domain certificates
| RSA key size |
Count |
| 2048 |
19 47.5% |
| 4096 |
21 52.5% |
StartTLS
| Type |
Client to server |
Server to server |
| Required |
22 78.6% |
9 56.3% |
| Allowed |
6 21.4% |
7 43.8% |
Trust
To do authenticated encryption, a certificate needs to be both trusted and valid. Trusted means it is issued by a well-known CA and valid means it is valid for the domain we want to connect to.
|
Trusted |
Untrusted |
| Valid |
0% |
4 8.2% |
| Invalid |
43 87.8% |
2 4.1% |
SASL mechanisms 28 results
| Mechanism |
# times offered before TLS |
# times offered after TLS |
| PLAIN |
3 10.7% |
25 89.3% |
| SCRAM-SHA-1 |
4 14.3% |
22 78.6% |
| SCRAM-SHA-1-PLUS |
0 0% |
12 42.9% |
| X-OAUTH2 |
0 0% |
4 14.3% |
| DIGEST-MD5 |
2 7.1% |
3 10.7% |
| LOGIN |
0 0% |
1 3.6% |
| CRAM-MD5 |
0 0% |
1 3.6% |
Servers supporting SSL 3, but not TLS 1.0 0 results
SSL 3 and TLS 1.0 are very similar, but TLS 1.0 has some small improvements. This table is meant to help judge whether SSL 3 can be disabled by listing the servers that do support SSL 3, but not TLS 1.0.
Servers supporting SSL 2 0 results
SSL 2 is broken and insecure. It is not required for compatibility and servers should disable it.
CAs used Top 30
| Name/Organization |
SHA1 |
Count |
| Let's Encrypt Authority X3 |
E6:A3:B4:5B:06:2D:50:9B:33:82:28:2D:19:6E:FE:97:D5:95:6C:CB |
31 |
| Go Daddy Secure Certificate Authority - G2 |
27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8 |
2 |
| SwissSign Server Silver CA 2014 - G22 |
55:BE:46:7A:A4:4B:F0:C1:5D:4B:CB:D0:6B:DC:A2:4B:BA:94:1E:13 |
1 |
| xtribeopenfire100.xtribe.local |
D1:14:29:98:93:84:F1:94:4A:81:5C:8B:DE:A5:F8:F7:7B:E7:8E:F8 |
1 |
Servers using <2048-bit RSA certificates which expires after 01-01-2014 0 results
As described in the CA/Browser Forum Baseline Requirements, certificates with RSA keys with less than 2048 bits should not be issued with an notAfter date after 31-12-2013. This list lists all certificates which violate that rule.
Servers with DNSSEC signed SRV records 23 results
Servers with DNSSEC signed DANE records 0 results
Servers with a hidden service 0 results
Servers not offering encryption 0 results
Servers sharing private keys 4 results
| Target |
SHA256(SPKI) |
| testxms.xtribeapp.com c2s |
ED:D7:8F:16:71:2D:07:E0:60:99:9B:BE:76:63:19:83:18:73:07:D2:50:55:C3:BC:33:BE:BE:19:7E:34:95:1F |
| xms.xtribeapp.com c2s |
ED:D7:8F:16:71:2D:07:E0:60:99:9B:BE:76:63:19:83:18:73:07:D2:50:55:C3:BC:33:BE:BE:19:7E:34:95:1F |
| usstaging.restcomm.com s2s |
F5:E7:9D:A6:04:70:77:39:01:AD:28:60:0B:F5:BE:70:B7:F0:78:E4:B6:51:AC:CA:56:EE:B2:80:E5:3E:24:C4 |
| usstaging-xmpp-synth-monitoring.restcomm.com s2s |
F5:E7:9D:A6:04:70:77:39:01:AD:28:60:0B:F5:BE:70:B7:F0:78:E4:B6:51:AC:CA:56:EE:B2:80:E5:3E:24:C4 |