Various reports of all servers tested

Report for december 2013 | Results of the last day | Results of the last week | Results of the last month

TLS versions 10 results

SSL 2 0 0%
SSL 3 0 0%
TLS 1.0 4 40%
TLS 1.1 4 40%
TLS 1.2 10 100%

Grades 10 results

A 7 70%
B 3 30%
C 0 0%
D 0 0%
E 0 0%
F 0 0%
Does not penalize untrusted certificates.

RSA key sizes for domain certificates

RSA key size Count
2048 5 50%
4096 5 50%

StartTLS

Type Client to server Server to server
Required 7 87.5% 1 50%
Allowed 1 12.5% 1 50%

Trust

To do authenticated encryption, a certificate needs to be both trusted and valid. Trusted means it is issued by a well-known CA and valid means it is valid for the domain we want to connect to.

Trusted Untrusted
Valid 0% 1 9.1%
Invalid 0% 10 90.9%

SASL mechanisms 8 results

Mechanism # times offered before TLS # times offered after TLS
PLAIN 1 12.5% 8 100%
SCRAM-SHA-1 1 12.5% 7 87.5%
SCRAM-SHA-1-PLUS 0 0% 5 62.5%
DIGEST-MD5 2 25% 2 25%
X-OAUTH2 1 12.5% 2 25%
LOGIN 0 0% 1 12.5%
CRAM-MD5 0 0% 1 12.5%

Servers supporting SSL 3, but not TLS 1.0 0 results

SSL 3 and TLS 1.0 are very similar, but TLS 1.0 has some small improvements. This table is meant to help judge whether SSL 3 can be disabled by listing the servers that do support SSL 3, but not TLS 1.0.

Target Type When

Servers supporting SSL 2 0 results

SSL 2 is broken and insecure. It is not required for compatibility and servers should disable it.

Target Type When

CAs used Top 30

Name/Organization SHA1 Count
R3 A0:53:37:5B:FE:84:E8:B7:48:78:2C:7C:EE:15:82:7A:6A:F5:A4:05 7
Thawte TLS RSA CA G1 C9:FE:FC:76:3D:95:48:B4:87:69:6F:04:7A:CB:A0:AB:E4:5C:7B:C1 1

Servers using <2048-bit RSA certificates which expires after 01-01-2014 0 results

As described in the CA/Browser Forum Baseline Requirements, certificates with RSA keys with less than 2048 bits should not be issued with an notAfter date after 31-12-2013. This list lists all certificates which violate that rule.

Target Type When Issuer

Servers with DNSSEC signed SRV records 1 results

Target Type When
mailbox.org client to server

Servers with DNSSEC signed DANE records 1 results

Target Type When
mailbox.org client to server

Servers with a hidden service 0 results

Target Type When

Servers not offering encryption 0 results

Target Type When

Servers sharing private keys 0 results

Target SHA256(SPKI)