Přihlásit se Registrace
Smlouvy Dotace Platy Úřady Zakázky Sponzoři & firmy PastVina 
❤ Podpořte nás Přihlásit se Registrace
Hledat v Hlídači státu
Nápověda jak vyhledávat Snadné hledání
  1. Hlídač Státu
  2. Hlídač Webů
  3. Detailní analýza HTTPs pro Karlovarský kraj

Hlídač Karlovarský kraj Detailní analýza HTTPs pro Karlovarský kraj

Karlovarský kraj
https://www.kr-karlovarsky.cz/

Karlovarský kraj Karlovarský kraj - webové stránky kraje

Zabezpečení komunikace

A
Certifikát expiruje za 39 dní.

Výsledek analýzy HTTPS na www.kr-karlovarsky.cz ze dne 30.06.2026

Všechno je v nejlepším pořádku a web se drží doporučených postupů.

Detailní analýza

Detailní report z HTTPs analýzy pomocí nástroje testssl.sh

server www.kr-karlovarsky.cz/185.8.237.6
pre_128cipher INFO { 
No 128 cipher limit bug
}
SSLv2 OK { 
not offered
}
SSLv3 OK { 
not offered
}
TLS1 INFO { 
not offered
}
TLS1_1 INFO { 
not offered
}
TLS1_2 OK { 
offered
}
TLS1_3 OK { 
offered with final
}
NPN INFO { 
not offered
}
ALPN_HTTP2 OK { 
h2
}
ALPN INFO { 
http/1.1
}
cipherlist_NULL
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_aNULL
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_EXPORT
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_LOW
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_3DES_IDEA
zranitelnosti: CWE-310
INFO { 
not offered
}
cipherlist_AVERAGE
zranitelnosti: CWE-310
INFO { 
not offered
}
cipherlist_GOOD INFO { 
not offered
}
cipherlist_STRONG OK { 
offered
}
cipher_order OK { 
server
}
protocol_negotiated OK { 
Default protocol TLS1.3
}
cipher_negotiated OK { 
TLS_CHACHA20_POLY1305_SHA256, 253 bit ECDH (X25519)
}
cipher-tls1_2_xcca8 OK { 
TLSv1.2   xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
}
cipher-tls1_2_xc030 OK { 
TLSv1.2   xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
}
cipher-tls1_2_xc02f OK { 
TLSv1.2   xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
}
cipherorder_TLSv1_2 INFO { 
ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256
}
cipher-tls1_3_x1303 OK { 
TLSv1.3   x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256
}
cipher-tls1_3_x1302 OK { 
TLSv1.3   x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384
}
cipher-tls1_3_x1301 OK { 
TLSv1.3   x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256
}
cipherorder_TLSv1_3 INFO { 
TLS_CHACHA20_POLY1305_SHA256 TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256
}
FS OK { 
offered
}
FS_ciphers INFO { 
TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
}
FS_ECDHE_curves OK { 
prime256v1 X25519
}
TLS_extensions INFO { 
'renegotiation info/#65281' 'server name/#0' 'EC point formats/#11' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'supported_groups/#10' 'max fragment length/#1' 'application layer protocol negotiation/#16' 'extended master secret/#23'
}
TLS_session_ticket INFO { 
valid for 1800 seconds only (<daily)
}
SSL_sessionID_support INFO { 
yes
}
sessionresumption_ticket INFO { 
not supported
}
sessionresumption_ID INFO { 
supported
}
TLS_timestamp INFO { 
random
}
certificate_compression INFO { 
none
}
clientAuth INFO { 
none
}
cert_numbers INFO { 
1
}
cert_signatureAlgorithm OK { 
SHA256 with RSA
}
cert_keySize INFO { 
RSA 2048 bits (exponent is 65537)
}
cert_keyUsage INFO { 
Digital Signature, Key Encipherment
}
cert_extKeyUsage INFO { 
TLS Web Server Authentication
}
cert_serialNumber INFO { 
05633F8C3F280B8918E0ABC91EC5F304AED8
}
cert_serialNumberLen INFO { 
18
}
cert_fingerprintSHA1 INFO { 
0D13952C39B37EC9FFF8968EB853E3BE2C288381
}
cert_fingerprintSHA256 INFO { 
24747C72AD5B812E94015A26936C260965850173257037768BA2DD0E091A4641
}
cert INFO { 
-----BEGIN CERTIFICATE----- MIIFEjCCA/qgAwIBAgISBWM/jD8oC4kY4KvJHsXzBK7YMA0GCSqGSIb3DQEBCwUA MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD EwNSMTMwHhcNMjYwNTEyMDQwMzA2WhcNMjYwODEwMDQwMzA1WjAcMRowGAYDVQQD ExFrci1rYXJsb3ZhcnNreS5jejCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAMpIic9Qi+dWmBPUY5PUUaqBhAXFwuL1V8sDItpmhFSe3EMJTXRp5t6OOlU9 Gcp5WQHkVLwg/MUl0dxhEPFoFpRf5QXDJkeiT0EI3sOeAZOwr1RJHjD3hF8ytWPs L3urC4IZYrwT5e/BBmYmJ4BNjtVKO07+Zg3y5/J/SCGhmC3AGinrI9grbp5SRuRu OCSo5UEdxk3Yt2R+ThRMmr/q4atISryQ53G1oog1Wk6V1PKOjAIWCqedd4eLp0tx gYPGs1urPhcfTVtW5WeSKA1aR46J0fCvGT0LKbpJ1G+q2ypzam7EtV6osSipRitg AjgYtQbntMxwbXdiNr4dZJeUm1kCAwEAAaOCAjUwggIxMA4GA1UdDwEB/wQEAwIF oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTA mu6BzLKc6JLcOAKqOo0KvNfUFTAfBgNVHSMEGDAWgBTnq58PLDOgU9NeT3jIsoQO O9aSMzAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTMuaS5s ZW5jci5vcmcvMDEGA1UdEQQqMCiCEyoua3Ita2FybG92YXJza3kuY3qCEWtyLWth cmxvdmFyc2t5LmN6MBMGA1UdIAQMMAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6Ah oB+GHWh0dHA6Ly9yMTMuYy5sZW5jci5vcmcvODkuY3JsMIIBDQYKKwYBBAHWeQIE AgSB/gSB+wD5AHYAlE5Dh/rswe+B8xkkJqgYZQHH0184AgE/cmd9VTcuGdgAAAGe Go/d6wAABAMARzBFAiEA3CRHKAUO5wH5lmmthSRuETphBngvKJRwSHWK+sKDOqoC IHORqCLAS48mLdkcrKbxUoMJADRubpggCKL6zJa0MBjzAH8ARq+GPTs+5Z+ld96o JF02sNntIqIj9GF3QSKUUu6VUF8AAAGeGo/eWgAIAAAFAAZcqccEAwBIMEYCIQDu iB575ZQmrRyqIxYtkd7Rxxpr6W0aIhr0d/uu8kslLwIhALk/fFZTMB0Ahcjx1S+M SN6AXH6xaOLhZZ76ItGCOlYgMA0GCSqGSIb3DQEBCwUAA4IBAQB5xhkS02xF9eBR RUQqe+M0Fr1D2IDZfjIdtcUPlnj6o83QoP2wDZa5NxbMriY/IQvLqJNjLFnIWOib ZfA4ORvJRV9taLdOyZJJwUd2LWn44+F5tZHstskwrs7kmIEgiEFxvudj69+28Xtl RlDPkqxaKKfOFKcge4F7D1TsrpEHSV+6Tf7BSpQXuaizjzPcmNWlNCrn5rbmPbCm tRcSqSsDTqCAACRv4nRMk86g8dm8EgfQxjDJLLdavwX9I58RDtM958PFEsAQN+3z M0FSQ5WM2goGMvtAEwgylwzZNYTczkqUp5vf5zsO5WztzKh0tFMNvXPaUO29cCm7 NWwdBLEB -----END CERTIFICATE-----
}
cert_commonName OK { 
kr-karlovarsky.cz
}
cert_commonName_wo_SNI INFO { 
request w/o SNI didn't succeed
}
cert_subjectAltName INFO { 
*.kr-karlovarsky.cz kr-karlovarsky.cz
}
cert_trust OK { 
Ok via SAN wildcard (SNI mandatory)
}
cert_chain_of_trust OK { 
passed.
}
cert_certificatePolicies_EV INFO { 
no
}
cert_expirationStatus OK { 
40 >= 30 days
}
cert_notBefore INFO { 
2026-05-12 04:03
}
cert_notAfter OK { 
2026-08-10 04:03
}
cert_extlifeSpan OK { 
certificate has no extended life time according to browser forum
}
cert_eTLS INFO { 
not present
}
cert_crlDistributionPoints INFO { 
http://r13.c.lencr.org/89.crl
}
cert_ocspURL INFO { 
--
}
OCSP_stapling INFO { 
not offered
}
cert_mustStapleExtension INFO { 
--
}
DNS_CAArecord OK { 
iodef=mailto:security@kr-karlovarsky.cz, issue=letsencrypt.org, issue=thawte.com
}
certificate_transparency OK { 
yes (certificate extension)
}
certs_countServer INFO { 
2
}
certs_list_ordering_problem INFO { 
no
}
cert_caIssuers INFO { 
R13 (Let's Encrypt from US)
}
intermediate_cert <#1> INFO { 
-----BEGIN CERTIFICATE----- MIIFBTCCAu2gAwIBAgIQWgDyEtjUtIDzkkFX6imDBTANBgkqhkiG9w0BAQsFADBP MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF bmNyeXB0MQwwCgYDVQQDEwNSMTMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQClZ3CN0FaBZBUXYc25BtStGZCMJlA3mBZjklTb2cyEBZPs0+wIG6BgUUNI fSvHSJaetC3ancgnO1ehn6vw1g7UDjDKb5ux0daknTI+WE41b0VYaHEX/D7YXYKg L7JRbLAaXbhZzjVlyIuhrxA3/+OcXcJJFzT/jCuLjfC8cSyTDB0FxLrHzarJXnzR yQH3nAP2/Apd9Np75tt2QnDr9E0i2gB3b9bJXxf92nUupVcM9upctuBzpWjPoXTi dYJ+EJ/B9aLrAek4sQpEzNPCifVJNYIKNLMc6YjCR06CDgo28EdPivEpBHXazeGa XP9enZiVuppD0EqiFwUBBDDTMrOPAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/ AgEAMB0GA1UdDgQWBBTnq58PLDOgU9NeT3jIsoQOO9aSMzAfBgNVHSMEGDAWgBR5 tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B AQsFAAOCAgEAUTdYUqEimzW7TbrOypLqCfL7VOwYf/Q79OH5cHLCZeggfQhDconl k7Kgh8b0vi+/XuWu7CN8n/UPeg1vo3G+taXirrytthQinAHGwc/UdbOygJa9zuBc VyqoH3CXTXDInT+8a+c3aEVMJ2St+pSn4ed+WkDp8ijsijvEyFwE47hulW0Ltzjg 9fOV5Pmrg/zxWbRuL+k0DBDHEJennCsAen7c35Pmx7jpmJ/HtgRhcnz0yjSBvyIw 6L1QIupkCv2SBODT/xDD3gfQQyKv6roV4G2EhfEyAsWpmojxjCUCGiyg97FvDtm/ NK2LSc9lybKxB73I2+P2G3CaWpvvpAiHCVu30jW8GCxKdfhsXtnIy2imskQqVZ2m 0Pmxobb28Tucr7xBK7CtwvPrb79os7u2XP3O5f9b/H66GNyRrglRXlrYjI1oGYL/ f4I1n/Sgusda6WvA6C190kxjU15Y12mHU4+BxyR9cx2hhGS9fAjMZKJss28qxvz6 Axu4CaDmRNZpK/pQrXF17yXCXkmEWgvSOEZy6Z9pcbLIVEGckV/iVeq0AOo2pkg9 p4QRIy0tK2diRENLSF2KysFwbY6B26BFeFs3v1sYVRhFW9nLkOrQVporCS0KyZmf wVD89qSTlnctLcZnIavjKsKUu1nA1iU0yYMdYepKR7lWbnwhdx3ewok= -----END CERTIFICATE-----
}
intermediate_cert_fingerprintSHA256 <#1> INFO { 
D3B128216A843F8EF1321501F5DF52A5DF52939EE2C19297712CD3DE4D419354
}
intermediate_cert_notBefore <#1> INFO { 
2024-03-13 00:00
}
intermediate_cert_notAfter <#1> OK { 
2027-03-12 23:59
}
intermediate_cert_expiration <#1> OK { 
ok > 40 days
}
intermediate_cert_chain <#1> INFO { 
R13 <-- ISRG Root X1
}
intermediate_cert_badOCSP OK { 
intermediate certificate(s) is/are ok
}
HTTP_status_code INFO { 
200 OK ('/')
}
HTTP_clock_skew INFO { 
-10207 seconds from localtime
}
HTTP_headerTime INFO { 
1782840627
}
HTTP_headerAge INFO { 
222 seconds
}
HSTS_time MEDIUM { 
max-age too short. 30 days (=2592000 seconds) < 15552000 seconds
}
HSTS_subdomains OK { 
includes subdomains
}
HSTS_preload INFO { 
domain is NOT marked for preloading
}
HPKP INFO { 
No support for HTTP Public Key Pinning
}
banner_server INFO { 
No Server banner line in header, interesting!
}
banner_application INFO { 
No application banner found
}
cookie_count INFO { 
2 at '/'
}
cookie_secure INFO { 
1/2 at '/' marked as secure
}
cookie_httponly INFO { 
1/2 at '/' marked as HttpOnly
}
cookie_bigip_f5
zranitelnosti: CWE-212
MEDIUM { 
Information leakage: F5 cookie BIGipServerweb0x_kr-karlovarsky_int_6080 503582892.49175.0000 is default IPv4 pool member 172.16.4.30:6080
}
X-Frame-Options OK { 
SAMEORIGIN
}
X-Content-Type-Options OK { 
nosniff
}
Referrer-Policy INFO { 
no-referrer-when-downgrade
}
Cache-Control INFO { 
max-age=3600, public
}
banner_reverseproxy
zranitelnosti: CWE-200
INFO { 
x-cache-ttl-remaining: 1577.590x-cache-age: 222x-cache-hits: 15x-cacheable: NO:Set-Cookie
}
heartbleed
zranitelnosti: CVE-2014-0160 CWE-119
OK { 
not vulnerable, no heartbeat extension
}
CCS
zranitelnosti: CVE-2014-0224 CWE-310
OK { 
not vulnerable
}
ticketbleed
zranitelnosti: CVE-2016-9244 CWE-200
OK { 
not vulnerable
}
ROBOT
zranitelnosti: CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168 CWE-203
OK { 
not vulnerable, no RSA key transport cipher
}
secure_renego
zranitelnosti: CWE-310
WARN { 
OpenSSL handshake didn't succeed
}
secure_client_renego
zranitelnosti: CVE-2011-1473 CWE-310
OK { 
not vulnerable
}
CRIME_TLS
zranitelnosti: CVE-2012-4929 CWE-310
OK { 
not vulnerable
}
BREACH
zranitelnosti: CVE-2013-3587 CWE-310
MEDIUM { 
potentially VULNERABLE, gzip br HTTP compression detected  - only supplied '/' tested
}
POODLE_SSL
zranitelnosti: CVE-2014-3566 CWE-310
OK { 
not vulnerable, no SSLv3
}
fallback_SCSV OK { 
no protocol below TLS 1.2 offered
}
SWEET32
zranitelnosti: CVE-2016-2183 CVE-2016-6329 CWE-327
OK { 
not vulnerable
}
FREAK
zranitelnosti: CVE-2015-0204 CWE-310
OK { 
not vulnerable
}
DROWN
zranitelnosti: CVE-2016-0800 CVE-2016-0703 CWE-310
OK { 
not vulnerable on this host and port
}
DROWN_hint
zranitelnosti: CVE-2016-0800 CVE-2016-0703 CWE-310
INFO { 
Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://censys.io/ipv4?q=24747C72AD5B812E94015A26936C260965850173257037768BA2DD0E091A4641
}
LOGJAM
zranitelnosti: CVE-2015-4000 CWE-310
OK { 
not vulnerable, no DH EXPORT ciphers,
}
LOGJAM-common_primes
zranitelnosti: CVE-2015-4000 CWE-310
OK { 
no DH key with <= TLS 1.2
}
BEAST
zranitelnosti: CVE-2011-3389 CWE-20
OK { 
not vulnerable, no SSL3 or TLS1
}
LUCKY13
zranitelnosti: CVE-2013-0169 CWE-310
OK { 
not vulnerable
}
winshock
zranitelnosti: CVE-2014-6321 CWE-94
OK { 
not vulnerable
}
RC4
zranitelnosti: CVE-2013-2566 CVE-2015-2808 CWE-310
OK { 
not vulnerable
}
clientsimulation-android_442 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-android_500 INFO { 
TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
}
clientsimulation-android_60 INFO { 
TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
}
clientsimulation-android_70 INFO { 
TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
}
clientsimulation-android_81 INFO { 
TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
}
clientsimulation-android_90 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-android_X INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-chrome_74_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-chrome_79_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-firefox_66_win81 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-firefox_71_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-ie_6_xp INFO { 
No connection
}
clientsimulation-ie_8_win7 INFO { 
No connection
}
clientsimulation-ie_8_xp INFO { 
No connection
}
clientsimulation-ie_11_win7 INFO { 
No connection
}
clientsimulation-ie_11_win81 INFO { 
No connection
}
clientsimulation-ie_11_winphone81 INFO { 
No connection
}
clientsimulation-ie_11_win10 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-edge_15_win10 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-edge_17_win10 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-opera_66_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-safari_9_ios9 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-safari_9_osx1011 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-safari_10_osx1012 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-safari_121_ios_122 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-safari_130_osx_10146 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-apple_ats_9_ios9 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-java_6u45 INFO { 
No connection
}
clientsimulation-java_7u25 INFO { 
No connection
}
clientsimulation-java_8u161 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-java1102 INFO { 
TLSv1.3 TLS_AES_256_GCM_SHA384
}
clientsimulation-java1201 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-openssl_102e INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-openssl_110l INFO { 
TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
}
clientsimulation-openssl_111d INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-thunderbird_68_3_1 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
rating_spec INFO { 
SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)
}
rating_doc INFO { 
https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
}
protocol_support_score INFO { 
100
}
protocol_support_score_weighted INFO { 
30
}
key_exchange_score INFO { 
90
}
key_exchange_score_weighted INFO { 
27
}
cipher_strength_score INFO { 
90
}
cipher_strength_score_weighted INFO { 
36
}
final_score INFO { 
93
}
overall_grade OK { 
A
}
grade_cap_reason_1 INFO { 
Grade capped to A. HSTS max-age is too short
}
server www.kr-karlovarsky.cz/185.8.237.5
pre_128cipher INFO { 
No 128 cipher limit bug
}
SSLv2 OK { 
not offered
}
SSLv3 OK { 
not offered
}
TLS1 INFO { 
not offered
}
TLS1_1 INFO { 
not offered
}
TLS1_2 OK { 
offered
}
TLS1_3 OK { 
offered with final
}
NPN INFO { 
not offered
}
ALPN_HTTP2 OK { 
h2
}
ALPN INFO { 
http/1.1
}
cipherlist_NULL
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_aNULL
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_EXPORT
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_LOW
zranitelnosti: CWE-327
OK { 
not offered
}
cipherlist_3DES_IDEA
zranitelnosti: CWE-310
INFO { 
not offered
}
cipherlist_AVERAGE
zranitelnosti: CWE-310
INFO { 
not offered
}
cipherlist_GOOD INFO { 
not offered
}
cipherlist_STRONG OK { 
offered
}
cipher_order OK { 
server
}
protocol_negotiated OK { 
Default protocol TLS1.3
}
cipher_negotiated OK { 
TLS_CHACHA20_POLY1305_SHA256, 253 bit ECDH (X25519)
}
cipher-tls1_2_xcca8 OK { 
TLSv1.2   xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
}
cipher-tls1_2_xc030 OK { 
TLSv1.2   xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
}
cipher-tls1_2_xc02f OK { 
TLSv1.2   xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
}
cipherorder_TLSv1_2 INFO { 
ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256
}
cipher-tls1_3_x1303 OK { 
TLSv1.3   x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256
}
cipher-tls1_3_x1302 OK { 
TLSv1.3   x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384
}
cipher-tls1_3_x1301 OK { 
TLSv1.3   x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256
}
cipherorder_TLSv1_3 INFO { 
TLS_CHACHA20_POLY1305_SHA256 TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256
}
FS OK { 
offered
}
FS_ciphers INFO { 
TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
}
FS_ECDHE_curves OK { 
prime256v1 X25519
}
TLS_extensions INFO { 
'renegotiation info/#65281' 'server name/#0' 'EC point formats/#11' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'supported_groups/#10' 'max fragment length/#1' 'application layer protocol negotiation/#16' 'extended master secret/#23'
}
TLS_session_ticket INFO { 
valid for 1800 seconds only (<daily)
}
SSL_sessionID_support INFO { 
yes
}
sessionresumption_ticket INFO { 
supported
}
sessionresumption_ID INFO { 
supported
}
TLS_timestamp INFO { 
random
}
certificate_compression INFO { 
none
}
clientAuth INFO { 
none
}
cert_numbers INFO { 
1
}
cert_signatureAlgorithm OK { 
SHA256 with RSA
}
cert_keySize INFO { 
RSA 2048 bits (exponent is 65537)
}
cert_keyUsage INFO { 
Digital Signature, Key Encipherment
}
cert_extKeyUsage INFO { 
TLS Web Server Authentication
}
cert_serialNumber INFO { 
05633F8C3F280B8918E0ABC91EC5F304AED8
}
cert_serialNumberLen INFO { 
18
}
cert_fingerprintSHA1 INFO { 
0D13952C39B37EC9FFF8968EB853E3BE2C288381
}
cert_fingerprintSHA256 INFO { 
24747C72AD5B812E94015A26936C260965850173257037768BA2DD0E091A4641
}
cert INFO { 
-----BEGIN CERTIFICATE----- MIIFEjCCA/qgAwIBAgISBWM/jD8oC4kY4KvJHsXzBK7YMA0GCSqGSIb3DQEBCwUA MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD EwNSMTMwHhcNMjYwNTEyMDQwMzA2WhcNMjYwODEwMDQwMzA1WjAcMRowGAYDVQQD ExFrci1rYXJsb3ZhcnNreS5jejCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAMpIic9Qi+dWmBPUY5PUUaqBhAXFwuL1V8sDItpmhFSe3EMJTXRp5t6OOlU9 Gcp5WQHkVLwg/MUl0dxhEPFoFpRf5QXDJkeiT0EI3sOeAZOwr1RJHjD3hF8ytWPs L3urC4IZYrwT5e/BBmYmJ4BNjtVKO07+Zg3y5/J/SCGhmC3AGinrI9grbp5SRuRu OCSo5UEdxk3Yt2R+ThRMmr/q4atISryQ53G1oog1Wk6V1PKOjAIWCqedd4eLp0tx gYPGs1urPhcfTVtW5WeSKA1aR46J0fCvGT0LKbpJ1G+q2ypzam7EtV6osSipRitg AjgYtQbntMxwbXdiNr4dZJeUm1kCAwEAAaOCAjUwggIxMA4GA1UdDwEB/wQEAwIF oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTA mu6BzLKc6JLcOAKqOo0KvNfUFTAfBgNVHSMEGDAWgBTnq58PLDOgU9NeT3jIsoQO O9aSMzAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTMuaS5s ZW5jci5vcmcvMDEGA1UdEQQqMCiCEyoua3Ita2FybG92YXJza3kuY3qCEWtyLWth cmxvdmFyc2t5LmN6MBMGA1UdIAQMMAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6Ah oB+GHWh0dHA6Ly9yMTMuYy5sZW5jci5vcmcvODkuY3JsMIIBDQYKKwYBBAHWeQIE AgSB/gSB+wD5AHYAlE5Dh/rswe+B8xkkJqgYZQHH0184AgE/cmd9VTcuGdgAAAGe Go/d6wAABAMARzBFAiEA3CRHKAUO5wH5lmmthSRuETphBngvKJRwSHWK+sKDOqoC IHORqCLAS48mLdkcrKbxUoMJADRubpggCKL6zJa0MBjzAH8ARq+GPTs+5Z+ld96o JF02sNntIqIj9GF3QSKUUu6VUF8AAAGeGo/eWgAIAAAFAAZcqccEAwBIMEYCIQDu iB575ZQmrRyqIxYtkd7Rxxpr6W0aIhr0d/uu8kslLwIhALk/fFZTMB0Ahcjx1S+M SN6AXH6xaOLhZZ76ItGCOlYgMA0GCSqGSIb3DQEBCwUAA4IBAQB5xhkS02xF9eBR RUQqe+M0Fr1D2IDZfjIdtcUPlnj6o83QoP2wDZa5NxbMriY/IQvLqJNjLFnIWOib ZfA4ORvJRV9taLdOyZJJwUd2LWn44+F5tZHstskwrs7kmIEgiEFxvudj69+28Xtl RlDPkqxaKKfOFKcge4F7D1TsrpEHSV+6Tf7BSpQXuaizjzPcmNWlNCrn5rbmPbCm tRcSqSsDTqCAACRv4nRMk86g8dm8EgfQxjDJLLdavwX9I58RDtM958PFEsAQN+3z M0FSQ5WM2goGMvtAEwgylwzZNYTczkqUp5vf5zsO5WztzKh0tFMNvXPaUO29cCm7 NWwdBLEB -----END CERTIFICATE-----
}
cert_commonName OK { 
kr-karlovarsky.cz
}
cert_commonName_wo_SNI INFO { 
request w/o SNI didn't succeed
}
cert_subjectAltName INFO { 
*.kr-karlovarsky.cz kr-karlovarsky.cz
}
cert_trust OK { 
Ok via SAN wildcard (SNI mandatory)
}
cert_chain_of_trust OK { 
passed.
}
cert_certificatePolicies_EV INFO { 
no
}
cert_expirationStatus OK { 
40 >= 30 days
}
cert_notBefore INFO { 
2026-05-12 04:03
}
cert_notAfter OK { 
2026-08-10 04:03
}
cert_extlifeSpan OK { 
certificate has no extended life time according to browser forum
}
cert_eTLS INFO { 
not present
}
cert_crlDistributionPoints INFO { 
http://r13.c.lencr.org/89.crl
}
cert_ocspURL INFO { 
--
}
OCSP_stapling INFO { 
not offered
}
cert_mustStapleExtension INFO { 
--
}
DNS_CAArecord OK { 
iodef=mailto:security@kr-karlovarsky.cz, issue=letsencrypt.org, issue=thawte.com
}
certificate_transparency OK { 
yes (certificate extension)
}
certs_countServer INFO { 
2
}
certs_list_ordering_problem INFO { 
no
}
cert_caIssuers INFO { 
R13 (Let's Encrypt from US)
}
intermediate_cert <#1> INFO { 
-----BEGIN CERTIFICATE----- MIIFBTCCAu2gAwIBAgIQWgDyEtjUtIDzkkFX6imDBTANBgkqhkiG9w0BAQsFADBP MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF bmNyeXB0MQwwCgYDVQQDEwNSMTMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQClZ3CN0FaBZBUXYc25BtStGZCMJlA3mBZjklTb2cyEBZPs0+wIG6BgUUNI fSvHSJaetC3ancgnO1ehn6vw1g7UDjDKb5ux0daknTI+WE41b0VYaHEX/D7YXYKg L7JRbLAaXbhZzjVlyIuhrxA3/+OcXcJJFzT/jCuLjfC8cSyTDB0FxLrHzarJXnzR yQH3nAP2/Apd9Np75tt2QnDr9E0i2gB3b9bJXxf92nUupVcM9upctuBzpWjPoXTi dYJ+EJ/B9aLrAek4sQpEzNPCifVJNYIKNLMc6YjCR06CDgo28EdPivEpBHXazeGa XP9enZiVuppD0EqiFwUBBDDTMrOPAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/ AgEAMB0GA1UdDgQWBBTnq58PLDOgU9NeT3jIsoQOO9aSMzAfBgNVHSMEGDAWgBR5 tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B AQsFAAOCAgEAUTdYUqEimzW7TbrOypLqCfL7VOwYf/Q79OH5cHLCZeggfQhDconl k7Kgh8b0vi+/XuWu7CN8n/UPeg1vo3G+taXirrytthQinAHGwc/UdbOygJa9zuBc VyqoH3CXTXDInT+8a+c3aEVMJ2St+pSn4ed+WkDp8ijsijvEyFwE47hulW0Ltzjg 9fOV5Pmrg/zxWbRuL+k0DBDHEJennCsAen7c35Pmx7jpmJ/HtgRhcnz0yjSBvyIw 6L1QIupkCv2SBODT/xDD3gfQQyKv6roV4G2EhfEyAsWpmojxjCUCGiyg97FvDtm/ NK2LSc9lybKxB73I2+P2G3CaWpvvpAiHCVu30jW8GCxKdfhsXtnIy2imskQqVZ2m 0Pmxobb28Tucr7xBK7CtwvPrb79os7u2XP3O5f9b/H66GNyRrglRXlrYjI1oGYL/ f4I1n/Sgusda6WvA6C190kxjU15Y12mHU4+BxyR9cx2hhGS9fAjMZKJss28qxvz6 Axu4CaDmRNZpK/pQrXF17yXCXkmEWgvSOEZy6Z9pcbLIVEGckV/iVeq0AOo2pkg9 p4QRIy0tK2diRENLSF2KysFwbY6B26BFeFs3v1sYVRhFW9nLkOrQVporCS0KyZmf wVD89qSTlnctLcZnIavjKsKUu1nA1iU0yYMdYepKR7lWbnwhdx3ewok= -----END CERTIFICATE-----
}
intermediate_cert_fingerprintSHA256 <#1> INFO { 
D3B128216A843F8EF1321501F5DF52A5DF52939EE2C19297712CD3DE4D419354
}
intermediate_cert_notBefore <#1> INFO { 
2024-03-13 00:00
}
intermediate_cert_notAfter <#1> OK { 
2027-03-12 23:59
}
intermediate_cert_expiration <#1> OK { 
ok > 40 days
}
intermediate_cert_chain <#1> INFO { 
R13 <-- ISRG Root X1
}
intermediate_cert_badOCSP OK { 
intermediate certificate(s) is/are ok
}
HTTP_status_code INFO { 
200 OK ('/')
}
HTTP_clock_skew INFO { 
-1 seconds from localtime
}
HTTP_headerTime INFO { 
1782851218
}
HTTP_headerAge INFO { 
1 seconds
}
HSTS_time MEDIUM { 
max-age too short. 30 days (=2592000 seconds) < 15552000 seconds
}
HSTS_subdomains OK { 
includes subdomains
}
HSTS_preload INFO { 
domain is NOT marked for preloading
}
HPKP INFO { 
No support for HTTP Public Key Pinning
}
banner_server INFO { 
No Server banner line in header, interesting!
}
banner_application INFO { 
No application banner found
}
cookie_count INFO { 
2 at '/'
}
cookie_secure INFO { 
1/2 at '/' marked as secure
}
cookie_httponly INFO { 
1/2 at '/' marked as HttpOnly
}
cookie_bigip_f5
zranitelnosti: CWE-212
MEDIUM { 
Information leakage: F5 cookie BIGipServerweb0x_kr-karlovarsky_int_6080 503582892.49175.0000 is default IPv4 pool member 172.16.4.30:6080
}
X-Frame-Options OK { 
SAMEORIGIN
}
X-Content-Type-Options OK { 
nosniff
}
Referrer-Policy INFO { 
no-referrer-when-downgrade
}
Cache-Control INFO { 
max-age=3600, public
}
banner_reverseproxy
zranitelnosti: CWE-200
INFO { 
x-cache-ttl-remaining: 1798.756x-cache-age: 1x-cache-hits: 2x-cacheable: NO:Set-Cookie
}
heartbleed
zranitelnosti: CVE-2014-0160 CWE-119
OK { 
not vulnerable, no heartbeat extension
}
CCS
zranitelnosti: CVE-2014-0224 CWE-310
OK { 
not vulnerable
}
ticketbleed
zranitelnosti: CVE-2016-9244 CWE-200
OK { 
not vulnerable
}
ROBOT
zranitelnosti: CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168 CWE-203
OK { 
not vulnerable, no RSA key transport cipher
}
secure_renego
zranitelnosti: CWE-310
WARN { 
OpenSSL handshake didn't succeed
}
secure_client_renego
zranitelnosti: CVE-2011-1473 CWE-310
OK { 
not vulnerable
}
CRIME_TLS
zranitelnosti: CVE-2012-4929 CWE-310
OK { 
not vulnerable
}
BREACH
zranitelnosti: CVE-2013-3587 CWE-310
MEDIUM { 
potentially VULNERABLE, gzip br HTTP compression detected  - only supplied '/' tested
}
POODLE_SSL
zranitelnosti: CVE-2014-3566 CWE-310
OK { 
not vulnerable, no SSLv3
}
fallback_SCSV OK { 
no protocol below TLS 1.2 offered
}
SWEET32
zranitelnosti: CVE-2016-2183 CVE-2016-6329 CWE-327
OK { 
not vulnerable
}
FREAK
zranitelnosti: CVE-2015-0204 CWE-310
OK { 
not vulnerable
}
DROWN
zranitelnosti: CVE-2016-0800 CVE-2016-0703 CWE-310
OK { 
not vulnerable on this host and port
}
DROWN_hint
zranitelnosti: CVE-2016-0800 CVE-2016-0703 CWE-310
INFO { 
Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://censys.io/ipv4?q=24747C72AD5B812E94015A26936C260965850173257037768BA2DD0E091A4641
}
LOGJAM
zranitelnosti: CVE-2015-4000 CWE-310
OK { 
not vulnerable, no DH EXPORT ciphers,
}
LOGJAM-common_primes
zranitelnosti: CVE-2015-4000 CWE-310
OK { 
no DH key with <= TLS 1.2
}
BEAST
zranitelnosti: CVE-2011-3389 CWE-20
OK { 
not vulnerable, no SSL3 or TLS1
}
LUCKY13
zranitelnosti: CVE-2013-0169 CWE-310
OK { 
not vulnerable
}
winshock
zranitelnosti: CVE-2014-6321 CWE-94
OK { 
not vulnerable
}
RC4
zranitelnosti: CVE-2013-2566 CVE-2015-2808 CWE-310
OK { 
not vulnerable
}
clientsimulation-android_442 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-android_500 INFO { 
TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
}
clientsimulation-android_60 INFO { 
TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
}
clientsimulation-android_70 INFO { 
TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
}
clientsimulation-android_81 INFO { 
TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
}
clientsimulation-android_90 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-android_X INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-chrome_74_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-chrome_79_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-firefox_66_win81 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-firefox_71_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-ie_6_xp INFO { 
No connection
}
clientsimulation-ie_8_win7 INFO { 
No connection
}
clientsimulation-ie_8_xp INFO { 
No connection
}
clientsimulation-ie_11_win7 INFO { 
No connection
}
clientsimulation-ie_11_win81 INFO { 
No connection
}
clientsimulation-ie_11_winphone81 INFO { 
No connection
}
clientsimulation-ie_11_win10 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-edge_15_win10 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-edge_17_win10 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-opera_66_win10 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-safari_9_ios9 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-safari_9_osx1011 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-safari_10_osx1012 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-safari_121_ios_122 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-safari_130_osx_10146 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-apple_ats_9_ios9 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-java_6u45 INFO { 
No connection
}
clientsimulation-java_7u25 INFO { 
No connection
}
clientsimulation-java_8u161 INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-java1102 INFO { 
TLSv1.3 TLS_AES_256_GCM_SHA384
}
clientsimulation-java1201 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-openssl_102e INFO { 
TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384
}
clientsimulation-openssl_110l INFO { 
TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305
}
clientsimulation-openssl_111d INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
clientsimulation-thunderbird_68_3_1 INFO { 
TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
}
rating_spec INFO { 
SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)
}
rating_doc INFO { 
https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
}
protocol_support_score INFO { 
100
}
protocol_support_score_weighted INFO { 
30
}
key_exchange_score INFO { 
90
}
key_exchange_score_weighted INFO { 
27
}
cipher_strength_score INFO { 
90
}
cipher_strength_score_weighted INFO { 
36
}
final_score INFO { 
93
}
overall_grade OK { 
A
}
grade_cap_reason_1 INFO { 
Grade capped to A. HSTS max-age is too short
}
scanTime INFO { 
333
}