Scanigma – Scanigma

C-

weak

C-

weak

Protocol

https

Domain

angora.id

Checked IP

104.21.58.202

Check Time

2026-08-20T12:23:58+00:00

Cache Time

2026-08-20T12:23:57+00:00

Protocol HTTPS (TLS)

Transport Layer Security (TLS) is a secure data transfer protocol that creates secure communication to leverage higher privacy. Widely used on the Internet, it is the successor of the ancient SSL. Several versions of the protocol are used in applications and services, TLS 1.3 is the most recent, but TLS 1.2 is very common too.

▼

Cipher suites

C-

▼

Highlighted findings

7 total protocol related checks

C-

Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)

['The {concept_tls_cipher_suite} {concept_key_exchange} algorithm has no {concept_forward_secrecy} ', 'property, but it is preferred over a cipher suite which is forward secret.']

['Remove the cipher suite from the list of cipher suites supported by your server or set the cipher suite ', 'order explicitly where forward secret cipher suites are preferred over non-forawrd secret ones.']

Weak Forward Secrecy (non forward secret algorithm)

['Key exchange method has no {concept_forward_secrecy}, and does not protect past sessions against ', 'future compromises. If long-term secret keys or passwords are compromised, encrypted communications and ', 'sessions recorded in the past can be retrieved and decrypted.']

['Remove the cipher suite from the list of cipher suites supported by your server.']

Weak Key Exchange Algorithm (RSA)

['{kex_rsa} key exchange is a {concept_key_exchange} that has no {concept_forward_secrecy}, and ', 'does not protect past sessions against future compromises. If long-term secret keys or passwords are ', 'compromised, encrypted communications and sessions recorded in the past can be retrieved and decrypted. ', 'Throughout its history RSA encryption has had many security flaws{kex_rsa_criticism} and was affected ', 'by variety of attack types: {concept_attack_chosen_ciphertext} (eg: {attack_bleichenbacher}, ', '{attack_robot}), {concept_attack_side_channel} (eg: {concept_attack_padding_oracle}, like ', '{attack_bleichenbachers_cat}).']

['Always prefer cipher suites with PFS property over the non-PFS ones. Note that performance ', 'considerations implies preferring {kex_ecdh_ephemeral} over {kex_dh_ephemeral}.']

B-

Moderate Authenticated Encryption Preference (CBC preferred over GCM)

['The {concept_tls_cipher_suite} {concept_block_cipher_mode} is {block_cipher_mode_cbc} is not an ', '{concept_authenticated_encryption} algorithm, but it is preferred over an authenticated one (', '{block_cipher_mode_gcm}, which provides integrity, and authenticity assurances on the data ', 'simultaneously.']

['Remove the cipher suite from the list of cipher suites supported by your server or set the cipher suite ', 'order explicitly and GCM cipher suites be preferred over CBC ones.']

Moderate Block Cipher Mode of Operation (CBC)

['Encryption mode is {block_cipher_mode_cbc}. It is vulnerable', '{block_cipher_mode_cbc_criticism} to {concept_timing_attack} (eg: {attack_lucky_thirteen}) and ', '{concept_attack_padding_oracle} (eg: {attack_poodle}).']

['Remove the cipher suite from the list of cipher suites supported by your server or at least set the ', 'cipher suite order explicitly and any cipher suite modes be preferred over ciphers suites with CBC modes.']

A-

Good MAC Algorithm (SHA-1)

['{concept_message_authentication_code} is a {concept_message_authentication_code_hash_based} which is ', 'considered secure{mac_sha1_criticism}, despite the fact that the underlaying', '{concept_cryptographic_hash_function} ({cryptographic_hash_function_sha1}) is considered insecure', '{cryptographic_hash_function_sha1_criticism}.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it. In case of a {concept_message_authentication_code_hash_based} prefer ', '{concept_message_authentication_code} based on {cryptographic_hash_function_sha2} over the ones based on ', '{cryptographic_hash_function_sha1}.']

A-

Good TLS Cipher Suite Preference (server cipher suites are preferred securely)

["Server prefers it's own {concept_tls_cipher_suite} order over client's cipher suite preference order. It ", 'may cause that less secure cipher suite is choosen in case of an improperly configured client. As not ', 'each {concept_tls_cipher_suite} supported by the server is considered secure, this is the best ', "possible configuration as long as server's preference order is correct. However it prevents the clients ", 'to choose their most preferred cipher suite, which may give them better performance (eg: ', 'ChaCha20/Poly1305 {encryption_algorithm_chacha20_poly1305}) on mobile devices under the same conditions ', 'of security.']

["Remove any intermediate or backward compatible cipher suite to make possible preferring client's cipher ", 'suite order without any security consideration.']

▶

Checked facts

16 total protocol related checks

Good Authenticated Encryption (not authenticated encryption)

['Encryption mode is not an {concept_authenticated_encryption} which could provide ', '{concept_confidentiality}, integrity, and authenticity assurances on the data.']

['Prefer cipher suites with authenticated encryption (AE) attribute.']

Good TLS Cipher Suite Preference (cipher suite order is correct)

["Server prefers it's own {concept_tls_cipher_suite} order over client's cipher suite preference order and ", 'does it may cause that less secure cipher suite is choosen in case of an improperly configured client. As not ', 'each {concept_tls_cipher_suite} supported by the server is considered secure, this is the best ', "possible configuration as long as server's preference order is correct. However it prevents the clients ", 'to choose their most preferred cipher suite, which may give them better performance (eg: ', 'ChaCha20/Poly1305 {encryption_algorithm_chacha20_poly1305}) on mobile devices under the same conditions ', 'of security.']

["Remove any intermediate or backward compatible cipher suite to make possible preferring client's cipher ", 'suite order without any security consideration.']

A+

Excellent Block Cipher Mode of Operation (GCM)

['{concept_block_cipher_mode} {block_cipher_mode_gcm} is considered secure. It provides ', '{concept_authenticated_encryption} which simultaneously assure the {concept_confidentiality} and ', '{concept_authenticity} of data.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it.']

A+

Excellent Digital Signature Algorithm (ECDSA)

['{digital_signature_algorithm_ecdsa} is the {concept_elliptic_curve_cryptography} based variant of the ', '{concept_digital_signature} names {digital_signature_algorithm_dsa} algorithm. It is considered secure ', '{digital_signature_algorithm_ecdsa_criticism} and gives better performance and smaller key sizes.']

A+

Excellent Digital Signature Algorithm (RSA)

['{digital_signature_algorithm_rsa} is a {concept_digital_signature} algorithm, which is considered ', 'secure, however there are known weaknesses{digital_signature_algorithm_rsa_criticism}.']

A+

Excellent Encryption Algorithm (AES)

['Encryption algorithm {encryption_algorithm_aes} is a {concept_block_cipher} for which there is no known ', 'practical attack that would allow the attacker to recover the encrypted text without knowledge of the ', 'key when the algorithm is implemented correctly. However improper implementations may lead to a ', '{concept_attack_side_channel} as it has happened in case of {implementation_openssl} ', '{encryption_algorithm_aes_criticism}.']

['Prefer cipher suites with greater key size of AES (eg: perfer AES-256 over AES-128).']

A+

Excellent Encryption Algorithm (ChaCha20)

['The {concept_stream_cipher} {encryption_algorithm_chacha20} is a variant of the algorithm ', '{encryption_algorithm_salsa20} is considered secure {encryption_algorithm_chacha20_poly1305_criticism} ', 'and gives better performance for mobile devices.']

['Prefer {concept_stream_cipher} {encryption_algorithm_chacha20} in case of mobile devices.']

A+

Excellent Encryption Block Size (encryption block size > 64 bits)

['The {concept_block_cipher} uses a {concept_block_size} larger than 64 bits, so it is not vulnerable to ', '{attack_sweet32}.']

A+

Excellent Encryption Block Size (encryption key size ≥ 128 bits)

['The {concept_symmetric_key_cryptography} with{concept_symmetric_key_algorithm_key_size} more than 128 ', 'bits as it is should be according to {organization_nist} so it is not vulnerable to ', '{concept_attack_preimage} and it cannreliably prove that message came from the stated sender (its ', 'authenticity) and has not been changed, so connection is not open for a {concept_attack_man_in_the_middle}.']

['Remove the cipher suite from the list of cipher suites supported by your server.']

A+

Excellent Authenticated Encryption (authenticated encryption)

['Encryption mode is an {concept_authenticated_encryption} which provides {concept_confidentiality}, ', 'integrity, and authenticity assurances on the data.']

A+

Excellent Key Exchange Algorithm (ECDHE)

['{kex_ecdh_ephemeral} is a variant of {concept_ecdh} key exchange that has ', '{concept_forward_secrecy}, and does protect past sessions against future compromises. If ', 'long-term secret keys or passwords are compromised, encrypted communications and sessions ', 'recorded in the past cannot be retrieved and decrypted.']

['Always prefer cipher suites with PFS property over the non-PFS ones. Note that performance ', 'considerations implies preferring {kex_ecdh_ephemeral} over {kex_dh_ephemeral}.']

A+

Excellent Forward Secrecy (forward secret algorithm)

['Key exchange method has {concept_forward_secrecy}, and does protect past sessions against future ', 'compromises. If long-term secret keys or passwords are compromised, encrypted communications and ', 'sessions recorded in the past cannot be retrieved and decrypted.']

['Always prefer cipher suites with FS property over the non-FS ones.']

A+

Excellent MAC Algorithm (Poly1305)

['{concept_message_authentication_code} is a {concept_message_authentication_code_universal_hashing_based} ', 'which is considered secure. It provides {concept_authenticated_encryption} which simultaneously assure ', 'the {concept_confidentiality} and {concept_authenticity} of data. Together with {concept_stream_cipher} ', 'ChaCha20{encryption_algorithm_chacha20_poly1305} gives better performance on mobile devices under the ', 'same conditions of security.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it. In case of a {concept_message_authentication_code_hash_based} prefer ', '{concept_message_authentication_code} based on {cryptographic_hash_function_sha2} over the ones based on ', '{cryptographic_hash_function_sha1}.']

A+

Excellent MAC Algorithm (SHA-2)

['{concept_message_authentication_code} is a {concept_message_authentication_code_hash_based} which is ', 'considered secure. The underlaying {concept_cryptographic_hash_function} ', '({cryptographic_hash_function_sha2}) is also considered secure.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it. In case of a {concept_message_authentication_code_hash_based} prefer ', '{concept_message_authentication_code} based on {cryptographic_hash_function_sha2} over the ones based on ', '{cryptographic_hash_function_sha1}.']

A+

Excellent TLS Cipher Suite Preference (client cipher suites are preferred)

["Server prefers client's {concept_tls_cipher_suite} order over its own cipher suite preference order. It ", 'may cause that less secure cipher suite is choosen in case of an improperly configured client, only if ', 'server supports less secure cipher suites. However it allows the clients to choose their most preferred ', 'cipher suite, which may give them better performance (eg: ChaCha20/Poly1305 ', '{encryption_algorithm_chacha20_poly1305}) on mobile devices under the same conditions of security.']

["Remove any intermediate or backward compatible cipher suite to make possible preferring client's cipher ", 'suite order without any security consideration.']

A+

Excellent TLS Cipher Suite Preference (client cipher suites are preferred securely)

["Server prefers client's {concept_tls_cipher_suite} order over its own cipher suite preference order. As ", 'each {concept_tls_cipher_suite} supported by the server is considered secure, this is the best ', 'configuration. It allows the clients to choose their most preferred cipher suite, which may give them ', 'better performance (eg: ChaCha20/Poly1305 {encryption_algorithm_chacha20_poly1305}) on mobile devices ', 'under the same conditions of security.']

▶

Detailed info

TLS 1.2
Grade	Order	Cipher suite name	Findings
A	1	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
A	2	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
B-	3	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA	Moderate Block Cipher Mode of Operation (CBC) Good MAC Algorithm (SHA-1) Moderate Authenticated Encryption Preference (CBC preferred over GCM)
A	4	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
B	5	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA	Moderate Block Cipher Mode of Operation (CBC) Good MAC Algorithm (SHA-1)
B	6	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	Moderate Block Cipher Mode of Operation (CBC)
B	7	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384	Moderate Block Cipher Mode of Operation (CBC)
A	8	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
A	9	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
B-	10	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	Moderate Block Cipher Mode of Operation (CBC) Good MAC Algorithm (SHA-1) Moderate Authenticated Encryption Preference (CBC preferred over GCM)
C-	11	TLS_RSA_WITH_AES_128_GCM_SHA256	Weak Key Exchange Algorithm (RSA) Weak Forward Secrecy (non forward secret algorithm) Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)
C-	12	TLS_RSA_WITH_AES_128_CBC_SHA	Weak Key Exchange Algorithm (RSA) Moderate Block Cipher Mode of Operation (CBC) Good MAC Algorithm (SHA-1) Weak Forward Secrecy (non forward secret algorithm) Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)
A	13	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
B	14	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	Moderate Block Cipher Mode of Operation (CBC) Good MAC Algorithm (SHA-1)
C-	15	TLS_RSA_WITH_AES_256_GCM_SHA384	Weak Key Exchange Algorithm (RSA) Weak Forward Secrecy (non forward secret algorithm) Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)
C-	16	TLS_RSA_WITH_AES_256_CBC_SHA	Weak Key Exchange Algorithm (RSA) Moderate Block Cipher Mode of Operation (CBC) Good MAC Algorithm (SHA-1) Weak Forward Secrecy (non forward secret algorithm) Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)
B	17	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	Moderate Block Cipher Mode of Operation (CBC)
C-	18	TLS_RSA_WITH_AES_128_CBC_SHA256	Weak Key Exchange Algorithm (RSA) Moderate Block Cipher Mode of Operation (CBC) Weak Forward Secrecy (non forward secret algorithm) Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)
B	19	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	Moderate Block Cipher Mode of Operation (CBC)
C	20	TLS_RSA_WITH_AES_256_CBC_SHA256	Weak Key Exchange Algorithm (RSA) Moderate Block Cipher Mode of Operation (CBC) Weak Forward Secrecy (non forward secret algorithm)

TLS 1.3
Grade	Order	Cipher suite name	Findings
A+		TLS_AES_128_GCM_SHA256
A+		TLS_AES_256_GCM_SHA384
A		TLS_CHACHA20_POLY1305_SHA256

▼

Key exchange

▼

Highlighted findings

0 total protocol related checks

Congratulations! We could not find any potential issues regarding your server configuration.

▶

Checked facts

5 total protocol related checks

Good Elliptic Curve Algorithm (elliptic curves designed by NIST)

['The {concept_elliptic_curve_cryptography} is an approach to {concept_public_key_cryptography} based on the ', '{concept_elliptic_curve}s. Note that there is controversy{elliptic_curve_design_nistp_criticism} around some of the ', '{organization_nist} designed elliptic curves{elliptic_curve_design_nistp}.']

['Add at least one elliptic curve to the list of elliptic curves supported by your server designed by ', 'independent researchers and prefer them as server configuration makes it possible.']

Good Elliptic Curve Algorithm (elliptic curves not post-quantum safe)

['The {concept_elliptic_curve} is not secure against a cryptanalytic attack by a quantum computer.']

['Add at least one quantum-safe elliptic curve to the list of elliptic curves supported by your server and prefer ', 'them as server configuration makes it possible.']

A+

Excellent Elliptic Curve Algorithm (elliptic curve designed by independent researcher)

['The {concept_elliptic_curve_cryptography} is an approach to {concept_public_key_cryptography} based on ', 'the {concept_elliptic_curve}s. Note that there is controversy{elliptic_curve_design_nistp_criticism} around some of the ', '{organization_nist} designed elliptic curves{elliptic_curve_design_nistp}. This {elliptic_curve_designer_independent} ', '{person_daniel_j_bernstein} and there is no evidence for any compromise.']

['Add at least one elliptic curve to the list of elliptic curves supported by your server designed by ', 'independent researchers and prefer them as server configuration makes it possible.']

A+

Excellent Elliptic Curve Algorithm (elliptic curve key size)

['The {concept_elliptic_curve_cryptography} is an approach to {concept_public_key_cryptography} based on ', 'the {concept_elliptic_curve}s. The most important property in terms of encryption strength, ', 'beyond the designer is {elliptic_curve_key_size}. All the key sizes available are considered secure, so ', 'there is no consideration about it.']

A+

Excellent Elliptic Curve Algorithm (elliptic curves post-quantum safe)

['The {concept_elliptic_curve} is secure against a cryptanalytic attack by a quantum computer.']

['Always prefer {concept_elliptic_curve} variants that secure against cryptanalytic attacks by a quantum computer ', 'over ones that are not.']

▶

Detailed info

Elliptic Curves
Grade	Name	Code	Key Size	Trusted Design	Post Quantum Safe
A+	X25519MLKEM768	0x11EC	1120	Yes	Yes
A+	x25519/Kyber-768-r3	0x6399	768	Yes	Yes
A	Curve25519	0x001D	256	Yes	No
A	prime256v1	0x0017	256	No	No
A	secp384r1	0x0018	384	No	No
A	secp521r1	0x0019	521	No	No

▼

Public keys

▼

Highlighted findings

1 total protocol related checks

Weak Public Key Revocation Check (OCSP stapling not supported)

['Server does not support revocation check mechanism {public_key_x509_revocation_ocsp_stapling}. ', 'Revocation check mechanisms of {public_key_x509} certificates have many flaws ', '{public_key_x509_revocation_criticism} and now, the only practically working and used vendor independent ', 'mechanisms is OCSP stapling.Without using a certificate revocation check mechanism a client applications ', '(eg: browser, email client, ...), cannot determine whether X.509 public key the server provides still ', 'valid or it has already been revoked by the issuer of the certificate. Without this information it ', 'cannot be reliably proved that message caomes from the stated sender (its authenticity) or it has been ', 'changed, so connections could be open for a {concept_attack_man_in_the_middle}.']

['Always chose {concept_certificate_authority}s which support {public_key_x509_revocation_ocsp}. Prefer ', 'server implementations which support {public_key_x509_revocation_ocsp_stapling} or use a proxy ', 'application make up for this shortcomings.']

▶

Checked facts

12 total protocol related checks

Good X.509 Public Key Subject (common name does not match)

['A {concept_digital_certificate} must contain a field called {public_key_x509_field_subject} and ', 'may contain {public_key_x509_extensions} including {public_key_x509_extension_subject_alternative_names}. ', 'During the {public_key_x509_hostname_validation} client applications (eg: browser, email client, ...) ', 'match {public_key_x509_field_subject_attribute_common_name} part of the subject and values of subject ', 'alternative names against the {concept_domain_name} of the connected server. Either the value of the ', 'common name attribute or one of the values of subject alternative name extension should match ', 'to the domain name exactly at least by a {concept_wildcard} in case of a {public_key_x509_wildcard}. ', 'The certificate provided by your server contains common names, but neither of its values matches the ', 'domain name.']

['Ensure that one of the values of the subject alternative names extension of the certificate provided by ', 'your server matches to the domain name. Consider the fact that old client (eg: browsers released before ', '2003) may not support{public_key_x509_extension_subject_alternative_names_criticism} the subject ', 'alternative names extension.']

Good X.509 Public Key Subject (subject alternative names do not match)

['A {concept_digital_certificate} must contain a field called {public_key_x509_field_subject} and ', 'may contain {public_key_x509_extensions} including {public_key_x509_extension_subject_alternative_names}. ', 'During the {public_key_x509_hostname_validation} client applications (eg: browser, email client, ...) ', 'match {public_key_x509_field_subject_attribute_common_name} part of the subject and values of subject ', 'alternative names against the {concept_domain_name} of the connected server. Either the value of the ', 'common name attribute or one of the values of subject alternative name extension should match ', 'to the domain name exactly at least by a {concept_wildcard} in case of a {public_key_x509_wildcard}. ', 'The certificate provided by your server contains subject alternative name extension, but neither of its ', 'values matches the domain name.']

['Ensure the common name part of the subject field of the certificate provided by your server matches ', 'to the domain name.']

A+

Excellent Digital Signature Algorithm (ECDSA)

A+

Excellent Digital Signature Algorithm (RSA)

['{digital_signature_algorithm_rsa} is a {concept_digital_signature} algorithm, which is considered ', 'secure, however there are known weaknesses{digital_signature_algorithm_rsa_criticism}.']

A+

Excellent Public Key Size (ECDSA with key size ≥ 224)

['The {concept_asymmetric_key_algorithm_key_size} in cryptography defines the upper-bound on an ', "algorithm's security. The {digital_signature_algorithm_ecdsa} is a {concept_digital_signature}. The ", 'ECDSA keys with size greater than or equal to 224 bits are considered secure according to ', '{organization_nist}.']

A+

Excellent Public Key Size (RSA with key size ≤ 2048)

['The {concept_asymmetric_key_algorithm_key_size} in cryptography defines the upper-bound on an ', "algorithm's security. The {public_key_cryptosystem_rsa} is a cryptosystem, which provides both ", '{concept_key_distribution}, {concept_digital_signature}. The RSA keys with size greater than or equal to ', '2048 bits are considered secure according to {organization_nist}.']

A+

Excellent X.509 Public Key Subject (common name does not match)

A+

Excellent Public Key Signature Hash Algorithm (root CA signature algorithm)

['A {concept_digital_certificate} which identifies a site can be signed by a ', '{concept_certificate_authority} or can be a {concept_digital_signature_self} (', '{concept_digital_certificate_chain_position_root}) having a {concept_digital_signature} in both cases, ', 'however it is needless to be verified in the latter case, so the security of the used ', '{concept_cryptographic_hash_function} does not matter.']

A+

Excellent X.509 Public Key Subject (subject alternative names do match)

['A {concept_digital_certificate} must contain a field called {public_key_x509_field_subject} and ', 'may contain {public_key_x509_extensions} including {public_key_x509_extension_subject_alternative_names}. ', 'During the {public_key_x509_hostname_validation} client applications (eg: browser, email client, ...) ', 'match {public_key_x509_field_subject_attribute_common_name} part of the subject and values of subject ', 'alternative names against the {concept_domain_name} of the connected server. Either the value of the ', 'common name attribute or one of the values of subject alternative name extension should match ', 'to the domain name exactly at least by a {concept_wildcard} in case of a {public_key_x509_wildcard}. ', 'The certificate provided by your server contains subject alternative name extension and one of its ', 'values matches the domain name.']

A+

Excellent X.509 Public Key Validation (domain-validated certificate)

['The {concept_digital_certificate} identifies the site is a {public_key_x509_validation_domain}, means ', 'that verification of the control over a DNS domain was required by the {concept_certificate_authority} ', 'to sign this certificate.']

['Take into consideration the advantages of a {public_key_x509_validation_domain} (eg: completely ', 'automated certificate {public_key_x509_renewal} process, possibly short validation period', '{public_key_x509_revocation_criticism}) over minor user experience improvement of an extended validation ', 'in certain client applications and the risk of a potential service outage caused by the manual ', 'certificate renewal{public_key_x509_validation_extended_criticism}.']

A+

Excellent X.509 Public Key Validity (certficate is valid)

['A {concept_digital_certificate} identifies a site is signed by a {concept_certificate_authority} ', 'certifies the ownership of a public key within a limited time period, called {public_key_x509_validity}. ', 'The current date and time is within the validity period of the public key provided by your server.']

['Restore the certificate, provided by your server, to the latest one, if it is available and its validity ', 'period has not ended yet, or initiate {public_key_x509_renewal} process if its validity period has ended ', 'yet. If there no available certificate create a completely new one and get is signed with a certificate ', 'authority.']

A+

Excellent Public Key Signature Hash Algorithm (SHA-2)

['The {concept_digital_certificate} which identifies the site is signed by a ', '{concept_certificate_authority} having {concept_digital_signature} with {signature_hash_algorithm_sha2} ', 'which uses {cryptographic_hash_function_sha2} as {concept_cryptographic_hash_function} considered ', 'secure.']

['Always provide certificate by your server to use signature algorithms with hash functions that are ', 'strong just like SHA-2 signature algorithms.']

▶

Detailed info

A+

Server Certificate

angora.id

+1 alternative name(s)

Valid From: 2026-08-16T16:37:42+00:00

Valid Until: 2026-11-14T17:36:22+00:00

A+

Intermediate CA

WR1

2023-12-13

2029-02-20

A+

Root CA

GTS Root R1

2016-06-22

2036-06-22

A+

Subject Info

Common Names

angora.id

Subject Alternative Names

angora.id

A+

Validity

Not Before

2026-08-16T16:37:42+00:00

Not After

2026-11-14T17:36:22+00:00

n/a

Issuer

Common Name

WR1

Organization Name

Google Trust Services

Country Name

A+

Fingerprints

MD5

63:22:87:DD:92:BE:C5:B1:54:B8:0C:4B:29:33:78:75

SHA1

3A:2F:D7:B1:21:1B:09:A7:19:34:0D:C9:57:EC:B2:A7:4A:A2:CD:46

SHA2_256

DC:86:30:F9:1E:A3:8C:87:62:B5:F3:5F:7C:74:56:CF:2E:0B:85:D7:99:8A:21:79:5E:8A:28:5D:E8:28:55:B0

A+

Public Key

Key Type

RSA

Key Size

2048

A+

Subject Info

Common Name

WR1

Organization Name

Google Trust Services

Country Name

A+

Validity

Not Before

2023-12-13T09:00:00+00:00

Not After

2029-02-20T14:00:00+00:00

n/a

Issuer

Common Name

GTS Root R1

Organization Name

Google Trust Services LLC

Country Name

A+

Fingerprints

MD5

94:FA:89:77:66:A2:3A:DA:CE:0E:09:66:6C:7C:FF:B3

SHA1

41:F0:91:69:2F:3B:70:80:3B:D1:FD:77:E9:29:63:D1:13:71:8C:D2

SHA2_256

B1:0B:6F:00:E6:09:50:9E:87:00:F6:D3:46:87:A2:BF:CE:38:EA:05:A8:FD:F1:CD:C4:0C:3A:2A:0D:0D:0E:45

A+

Public Key

Key Type

RSA

Key Size

2048

A+

Subject Info

Common Name

GTS Root R1

Organization Name

Google Trust Services LLC

Country Name

A+

Validity

Not Before

2016-06-22T00:00:00+00:00

Not After

2036-06-22T00:00:00+00:00

n/a

Issuer

Common Name

GTS Root R1

Organization Name

Google Trust Services LLC

Country Name

A+

Fingerprints

MD5

05:FE:D0:BF:71:A8:A3:76:63:DA:01:E0:D8:52:DC:40

SHA1

E5:8C:1C:C4:91:3B:38:63:4B:E9:10:6E:E3:AD:8E:6B:9D:D9:81:4A

SHA2_256

D9:47:43:2A:BD:E7:B7:FA:90:FC:2E:6B:59:10:1B:12:80:E0:E1:C7:E4:E4:0F:A3:C6:88:7F:FF:57:A7:F4:CF

A+

Public Key

Key Type

RSA

Key Size

4096

Server Certificate

angora.id

+1 alternative name(s)

Valid From: 2026-08-16T16:37:57+00:00

Valid Until: 2026-11-14T17:37:48+00:00

A+

Intermediate CA

WE1

2023-12-13

2029-02-20

A+

Root CA

GTS Root R4

2016-06-22

2036-06-22

Subject Info

Common Names

angora.id

Subject Alternative Names

angora.id

A+

Validity

Not Before

2026-08-16T16:37:57+00:00

Not After

2026-11-14T17:37:48+00:00

n/a

Issuer

Common Name

WE1

Organization Name

Google Trust Services

Country Name

A+

Fingerprints

MD5

E9:EA:4A:61:8A:24:0B:1D:DF:78:00:A5:68:2B:9F:9D

SHA1

B7:D2:4F:B0:5B:C1:EC:84:D9:D4:1D:F6:EA:43:BF:72:B9:8B:99:E1

SHA2_256

CD:7F:A6:12:EB:4A:A0:66:D3:9E:3F:CD:2F:97:BC:CE:40:50:9F:2E:8E:E8:83:C1:A8:DC:91:AA:B9:71:E3:DA

A+

Public Key

Key Type

ECDSA

Key Size

256

A+

Subject Info

Common Name

WE1

Organization Name

Google Trust Services

Country Name

A+

Validity

Not Before

2023-12-13T09:00:00+00:00

Not After

2029-02-20T14:00:00+00:00

n/a

Issuer

Common Name

GTS Root R4

Organization Name

Google Trust Services LLC

Country Name

A+

Fingerprints

MD5

E8:D4:45:56:34:2D:AB:C7:32:D2:6B:82:49:BC:A4:91

SHA1

10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2

SHA2_256

1D:FC:16:05:FB:AD:35:8D:8B:C8:44:F7:6D:15:20:3F:AC:9C:A5:C1:A7:9F:D4:85:7F:FA:F2:86:4F:BE:BF:96

A+

Public Key

Key Type

ECDSA

Key Size

256

A+

Subject Info

Common Name

GTS Root R4

Organization Name

Google Trust Services LLC

Country Name

A+

Validity

Not Before

2016-06-22T00:00:00+00:00

Not After

2036-06-22T00:00:00+00:00

n/a

Issuer

Common Name

GTS Root R4

Organization Name

Google Trust Services LLC

Country Name

A+

Fingerprints

MD5

43:96:83:77:19:4D:76:B3:9D:65:52:E4:1D:22:A5:E8

SHA1

77:D3:03:67:B5:E0:0C:15:F6:0C:38:61:DF:7C:E1:3B:92:46:4D:47

SHA2_256

34:9D:FA:40:58:C5:E2:63:12:3B:39:8A:E7:95:57:3C:4E:13:13:C8:3F:E6:8F:93:55:6C:D5:E8:03:1B:3C:7D

A+

Public Key

Key Type

ECDSA

Key Size

384

n/a

Certificate Transparency

Google

Google 'Xenon2026h2' log

DigiCert

DigiCert 'Sphinx2026h2'

▼

Versions

A+

▼

Highlighted findings

0 total protocol related checks

Congratulations! We could not find any potential issues regarding your server configuration.

▶

Checked facts

2 total protocol related checks

▶

Detailed info

Grade	Enabled Protocol	Findings
A+	TLS 1.3
A+	TLS 1.2