Scanigma – Scanigma

A-

good

A-

good

Protocol

https

Domain

ifppm.org

Checked IP

35.209.241.215

Check Time

2026-08-06T03:28:17+00:00

Cache Time

2026-08-05T03:36:18+00:00

Protocol HTTPS (TLS)

Transport Layer Security (TLS) is a secure data transfer protocol that creates secure communication to leverage higher privacy. Widely used on the Internet, it is the successor of the ancient SSL. Several versions of the protocol are used in applications and services, TLS 1.3 is the most recent, but TLS 1.2 is very common too.

▼

Cipher suites

A-

▼

Highlighted findings

1 total protocol related checks

A-

Good TLS Cipher Suite Preference (server cipher suites are preferred unnecessarily)

['Each {concept_tls_cipher_suite} supported by the server is considered secure, however it prefers its own ', 'cipher suite preference order client cipher suite preference order, which prevents the clients to choose ', 'their most preferred cipher suite, which may give them better performance (eg: ChaCha20/Poly1305 ', '{encryption_algorithm_chacha20_poly1305}) on mobile devices under the same conditions of security.']

['Set preference of client cipher suite order.']

▶

Checked facts

15 total protocol related checks

Good Authenticated Encryption (not authenticated encryption)

['Encryption mode is not an {concept_authenticated_encryption} which could provide ', '{concept_confidentiality}, integrity, and authenticity assurances on the data.']

['Prefer cipher suites with authenticated encryption (AE) attribute.']

Good Key Exchange Algorithm (Ephemeral Diffie-Hellman)

['{kex_dh_ephemeral} is a variant of {concept_dh} {concept_key_exchange} protocol that has ', '{concept_forward_secrecy}, and does protect past sessions against future compromises. If long-term secret keys ', 'or passwords are compromised, encrypted communications and sessions recorded in the past cannot be retrieved and ', 'decrypted. However, there is a protocol flaw called {attack_dheat}, a {concept_attack_denial_of_service}, which ', 'can be exploited effectively when large key sizes are enabled.']

['Always prefer cipher suites with PFS property over the non-PFS ones. Note that performance considerations ', 'implies preferring {kex_ecdh_ephemeral} over {kex_dh_ephemeral} and {attack_dheat} implies using {kex_dh_param}s ', 'with a size greater or equal than 2048 bits but less or equal than 4096 bits.']

Good TLS Cipher Suite Preference (cipher suite order is correct)

["Server prefers it's own {concept_tls_cipher_suite} order over client's cipher suite preference order and ", 'does it may cause that less secure cipher suite is choosen in case of an improperly configured client. As not ', 'each {concept_tls_cipher_suite} supported by the server is considered secure, this is the best ', "possible configuration as long as server's preference order is correct. However it prevents the clients ", 'to choose their most preferred cipher suite, which may give them better performance (eg: ', 'ChaCha20/Poly1305 {encryption_algorithm_chacha20_poly1305}) on mobile devices under the same conditions ', 'of security.']

["Remove any intermediate or backward compatible cipher suite to make possible preferring client's cipher ", 'suite order without any security consideration.']

A+

Excellent Block Cipher Mode of Operation (CCM)

['{concept_block_cipher_mode} {block_cipher_mode_ccm} is considered secure. It provides ', 'provides {concept_authenticated_encryption} which simultaneously assure the {concept_confidentiality} and ', '{concept_authenticity} of data.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it.']

A+

Excellent Block Cipher Mode of Operation (GCM)

['{concept_block_cipher_mode} {block_cipher_mode_gcm} is considered secure. It provides ', '{concept_authenticated_encryption} which simultaneously assure the {concept_confidentiality} and ', '{concept_authenticity} of data.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it.']

A+

Excellent Digital Signature Algorithm (RSA)

['{digital_signature_algorithm_rsa} is a {concept_digital_signature} algorithm, which is considered ', 'secure, however there are known weaknesses{digital_signature_algorithm_rsa_criticism}.']

A+

Excellent Encryption Algorithm (AES)

['Encryption algorithm {encryption_algorithm_aes} is a {concept_block_cipher} for which there is no known ', 'practical attack that would allow the attacker to recover the encrypted text without knowledge of the ', 'key when the algorithm is implemented correctly. However improper implementations may lead to a ', '{concept_attack_side_channel} as it has happened in case of {implementation_openssl} ', '{encryption_algorithm_aes_criticism}.']

['Prefer cipher suites with greater key size of AES (eg: perfer AES-256 over AES-128).']

A+

Excellent Encryption Algorithm (ChaCha20)

['The {concept_stream_cipher} {encryption_algorithm_chacha20} is a variant of the algorithm ', '{encryption_algorithm_salsa20} is considered secure {encryption_algorithm_chacha20_poly1305_criticism} ', 'and gives better performance for mobile devices.']

['Prefer {concept_stream_cipher} {encryption_algorithm_chacha20} in case of mobile devices.']

A+

Excellent Encryption Block Size (encryption block size > 64 bits)

['The {concept_block_cipher} uses a {concept_block_size} larger than 64 bits, so it is not vulnerable to ', '{attack_sweet32}.']

A+

Excellent Encryption Block Size (encryption key size ≥ 128 bits)

['The {concept_symmetric_key_cryptography} with{concept_symmetric_key_algorithm_key_size} more than 128 ', 'bits as it is should be according to {organization_nist} so it is not vulnerable to ', '{concept_attack_preimage} and it cannreliably prove that message came from the stated sender (its ', 'authenticity) and has not been changed, so connection is not open for a {concept_attack_man_in_the_middle}.']

['Remove the cipher suite from the list of cipher suites supported by your server.']

A+

Excellent Authenticated Encryption (authenticated encryption)

['Encryption mode is an {concept_authenticated_encryption} which provides {concept_confidentiality}, ', 'integrity, and authenticity assurances on the data.']

A+

Excellent Key Exchange Algorithm (ECDHE)

['{kex_ecdh_ephemeral} is a variant of {concept_ecdh} key exchange that has ', '{concept_forward_secrecy}, and does protect past sessions against future compromises. If ', 'long-term secret keys or passwords are compromised, encrypted communications and sessions ', 'recorded in the past cannot be retrieved and decrypted.']

['Always prefer cipher suites with PFS property over the non-PFS ones. Note that performance ', 'considerations implies preferring {kex_ecdh_ephemeral} over {kex_dh_ephemeral}.']

A+

Excellent Forward Secrecy (forward secret algorithm)

['Key exchange method has {concept_forward_secrecy}, and does protect past sessions against future ', 'compromises. If long-term secret keys or passwords are compromised, encrypted communications and ', 'sessions recorded in the past cannot be retrieved and decrypted.']

['Always prefer cipher suites with FS property over the non-FS ones.']

A+

Excellent MAC Algorithm (Poly1305)

['{concept_message_authentication_code} is a {concept_message_authentication_code_universal_hashing_based} ', 'which is considered secure. It provides {concept_authenticated_encryption} which simultaneously assure ', 'the {concept_confidentiality} and {concept_authenticity} of data. Together with {concept_stream_cipher} ', 'ChaCha20{encryption_algorithm_chacha20_poly1305} gives better performance on mobile devices under the ', 'same conditions of security.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it. In case of a {concept_message_authentication_code_hash_based} prefer ', '{concept_message_authentication_code} based on {cryptographic_hash_function_sha2} over the ones based on ', '{cryptographic_hash_function_sha1}.']

A+

Excellent MAC Algorithm (SHA-2)

['{concept_message_authentication_code} is a {concept_message_authentication_code_hash_based} which is ', 'considered secure. The underlaying {concept_cryptographic_hash_function} ', '({cryptographic_hash_function_sha2}) is also considered secure.']

['If your application or requirements specifically call for the use of a ', '{concept_message_authentication_code} that does not provide {concept_authenticated_encryption} prefer ', '{concept_block_cipher_mode} (eg: {block_cipher_mode_ccm}, {block_cipher_mode_gcm} or ', '{concept_message_authentication_code} (eg: {mac_poly1305}) that proved authenticated encryption over the ', 'ones which does not provide it. In case of a {concept_message_authentication_code_hash_based} prefer ', '{concept_message_authentication_code} based on {cryptographic_hash_function_sha2} over the ones based on ', '{cryptographic_hash_function_sha1}.']

▶

Detailed info

TLS 1.2
Grade	Order	Cipher suite name
A	1	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
A	2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
A	3	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
A	4	TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
A	5	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS 1.3
Grade	Order	Cipher suite name
A	1	TLS_AES_256_GCM_SHA384
A	2	TLS_CHACHA20_POLY1305_SHA256
A	3	TLS_AES_128_GCM_SHA256
A	4	TLS_AES_128_CCM_SHA256

▼

Key exchange

▼

Highlighted findings

0 total protocol related checks

Congratulations! We could not find any potential issues regarding your server configuration.

▶

Checked facts

7 total protocol related checks

Good Elliptic Curve Algorithm (elliptic curves designed by NIST)

['The {concept_elliptic_curve_cryptography} is an approach to {concept_public_key_cryptography} based on the ', '{concept_elliptic_curve}s. Note that there is controversy{elliptic_curve_design_nistp_criticism} around some of the ', '{organization_nist} designed elliptic curves{elliptic_curve_design_nistp}.']

['Add at least one elliptic curve to the list of elliptic curves supported by your server designed by ', 'independent researchers and prefer them as server configuration makes it possible.']

Good Elliptic Curve Algorithm (elliptic curves not post-quantum safe)

['The {concept_elliptic_curve} is not secure against a cryptanalytic attack by a quantum computer.']

['Add at least one quantum-safe elliptic curve to the list of elliptic curves supported by your server and prefer ', 'them as server configuration makes it possible.']

A+

Excellent Elliptic Curve Algorithm (elliptic curve key size)

['The {concept_elliptic_curve_cryptography} is an approach to {concept_public_key_cryptography} based on ', 'the {concept_elliptic_curve}s. The most important property in terms of encryption strength, ', 'beyond the designer is {elliptic_curve_key_size}. All the key sizes available are considered secure, so ', 'there is no consideration about it.']

A+

Excellent Diffie-Hellman Parameter Well-Know (custom DH parameter)

['The {kex_dh_param} is a {kex_dh_param_custom}, so parameters are necessarily selected appropriately and ', 'the public keys are not necessarily validated appropriately, so they may vulnerable against ', '{concept_attack_small_subgroup}, however with appropriately choosen parameter size and validated parameters ', 'it is considered more security than the a {kex_dh_param_well_known}.']

['Use a {kex_dh_param_well_known}, or generate a custom {kex_dh_param} with a size greater or equal than 2048 bits but ', 'less or equal than 4096 bits. In the case of custom parameters, validate that the prime is a {concept_safe_prime} ', 'to avoid a {concept_attack_small_subgroup}.']

A+

Excellent Diffie-Hellman Parameter Reuse (DH param not reused)

['The {kex_dh_param} is uniqe between key agreements. It prevents {concept_attack_small_subgroup} even if ', 'parameters are not appropriately selected or if public keys are not appropriately validated and also ', 'prevents {attack_raccoon}, which is a {concept_attack_side_channel} against {kex_dh_ephemeral}.']

A+

Excellent Diffie-Hellman Parameter Prime (Diffie-Hellman parameter safe prime)

['{kex_dh_param} contains a {concept_safe_prime}, so the connection is certainly not vulnerable to a ', '{concept_attack_small_subgroup}.']

A+

Excellent Diffie-Hellman Parameter Size (>=2048)

['The {kex_dh_param} with {kex_dh_param_size_gte_2048} is considered secure, not weakened against ', '{attack_logjam}.']

['Use a {kex_dh_param_well_known}, or generate a custom {kex_dh_param} with a size greater or equal than 2048 bits but ', 'less or equal than 4096 bits. In the case of custom parameters, validate that the prime is a {concept_safe_prime} ', 'to avoid a {concept_attack_small_subgroup}.']

▶

Detailed info

Elliptic Curves
Grade	Name	Code	Key Size	Trusted Design	Post Quantum Safe	Findings
A	secp384r1	0x0018	384	No	No

▼

Public keys

▼

Highlighted findings

0 total protocol related checks

Congratulations! We could not find any potential issues regarding your server configuration.

▶

Checked facts

9 total protocol related checks

Good X.509 Public Key Subject (common name does not match)

['A {concept_digital_certificate} must contain a field called {public_key_x509_field_subject} and ', 'may contain {public_key_x509_extensions} including {public_key_x509_extension_subject_alternative_names}. ', 'During the {public_key_x509_hostname_validation} client applications (eg: browser, email client, ...) ', 'match {public_key_x509_field_subject_attribute_common_name} part of the subject and values of subject ', 'alternative names against the {concept_domain_name} of the connected server. Either the value of the ', 'common name attribute or one of the values of subject alternative name extension should match ', 'to the domain name exactly at least by a {concept_wildcard} in case of a {public_key_x509_wildcard}. ', 'The certificate provided by your server contains common names, but neither of its values matches the ', 'domain name.']

['Ensure that one of the values of the subject alternative names extension of the certificate provided by ', 'your server matches to the domain name. Consider the fact that old client (eg: browsers released before ', '2003) may not support{public_key_x509_extension_subject_alternative_names_criticism} the subject ', 'alternative names extension.']

A+

Excellent Digital Signature Algorithm (RSA)

['{digital_signature_algorithm_rsa} is a {concept_digital_signature} algorithm, which is considered ', 'secure, however there are known weaknesses{digital_signature_algorithm_rsa_criticism}.']

A+

Excellent Public Key Size (RSA with key size ≤ 2048)

['The {concept_asymmetric_key_algorithm_key_size} in cryptography defines the upper-bound on an ', "algorithm's security. The {public_key_cryptosystem_rsa} is a cryptosystem, which provides both ", '{concept_key_distribution}, {concept_digital_signature}. The RSA keys with size greater than or equal to ', '2048 bits are considered secure according to {organization_nist}.']

A+

Excellent Public Key Revocation Check (OCSP stapling not applicable)

["The certificate authority that issued the server's certificate does not provide an OCSP responder, ", 'so {public_key_x509_revocation_ocsp_stapling} is not applicable.']

['Consider using a {concept_certificate_authority} that supports {public_key_x509_revocation_ocsp} ', 'to enable {public_key_x509_revocation_ocsp_stapling}.']

A+

Excellent Public Key Signature Hash Algorithm (root CA signature algorithm)

['A {concept_digital_certificate} which identifies a site can be signed by a ', '{concept_certificate_authority} or can be a {concept_digital_signature_self} (', '{concept_digital_certificate_chain_position_root}) having a {concept_digital_signature} in both cases, ', 'however it is needless to be verified in the latter case, so the security of the used ', '{concept_cryptographic_hash_function} does not matter.']

A+

Excellent X.509 Public Key Subject (subject alternative names do match)

['A {concept_digital_certificate} must contain a field called {public_key_x509_field_subject} and ', 'may contain {public_key_x509_extensions} including {public_key_x509_extension_subject_alternative_names}. ', 'During the {public_key_x509_hostname_validation} client applications (eg: browser, email client, ...) ', 'match {public_key_x509_field_subject_attribute_common_name} part of the subject and values of subject ', 'alternative names against the {concept_domain_name} of the connected server. Either the value of the ', 'common name attribute or one of the values of subject alternative name extension should match ', 'to the domain name exactly at least by a {concept_wildcard} in case of a {public_key_x509_wildcard}. ', 'The certificate provided by your server contains subject alternative name extension and one of its ', 'values matches the domain name.']

A+

Excellent X.509 Public Key Validation (domain-validated certificate)

['The {concept_digital_certificate} identifies the site is a {public_key_x509_validation_domain}, means ', 'that verification of the control over a DNS domain was required by the {concept_certificate_authority} ', 'to sign this certificate.']

['Take into consideration the advantages of a {public_key_x509_validation_domain} (eg: completely ', 'automated certificate {public_key_x509_renewal} process, possibly short validation period', '{public_key_x509_revocation_criticism}) over minor user experience improvement of an extended validation ', 'in certain client applications and the risk of a potential service outage caused by the manual ', 'certificate renewal{public_key_x509_validation_extended_criticism}.']

A+

Excellent X.509 Public Key Validity (certficate is valid)

['A {concept_digital_certificate} identifies a site is signed by a {concept_certificate_authority} ', 'certifies the ownership of a public key within a limited time period, called {public_key_x509_validity}. ', 'The current date and time is within the validity period of the public key provided by your server.']

['Restore the certificate, provided by your server, to the latest one, if it is available and its validity ', 'period has not ended yet, or initiate {public_key_x509_renewal} process if its validity period has ended ', 'yet. If there no available certificate create a completely new one and get is signed with a certificate ', 'authority.']

A+

Excellent Public Key Signature Hash Algorithm (SHA-2)

['The {concept_digital_certificate} which identifies the site is signed by a ', '{concept_certificate_authority} having {concept_digital_signature} with {signature_hash_algorithm_sha2} ', 'which uses {cryptographic_hash_function_sha2} as {concept_cryptographic_hash_function} considered ', 'secure.']

['Always provide certificate by your server to use signature algorithms with hash functions that are ', 'strong just like SHA-2 signature algorithms.']

▶

Detailed info

Server Certificate

*.ifppm.org

+2 alternative name(s)

Valid From: 2026-06-06T13:35:17+00:00

Valid Until: 2026-09-04T13:35:16+00:00

A+

Intermediate CA

YR1

2025-09-03

2028-09-02

A+

Intermediate CA

Root YR

2026-05-13

2032-09-02

A+

Root CA

ISRG Root X1

2015-06-04

2035-06-04

Subject Info

Common Names

*.ifppm.org

Subject Alternative Names

*.ifppm.org
ifppm.org

A+

Validity

Not Before

2026-06-06T13:35:17+00:00

Not After

2026-09-04T13:35:16+00:00

n/a

Issuer

Common Name

YR1

Organization Name

Let's Encrypt

Country Name

A+

Fingerprints

MD5

57:28:65:64:A5:CB:DA:92:1B:D2:3E:95:ED:FA:6D:C3

SHA1

25:5C:0A:89:02:D3:6B:AB:66:20:F7:E2:D9:45:4D:EA:4E:28:A5:4E

SHA2_256

71:9F:F1:0E:F1:31:99:93:2D:EF:62:AC:4A:64:66:39:31:7A:FE:0C:26:C0:F6:4A:EF:E5:87:CF:C2:93:60:B3

A+

Public Key

Key Type

RSA

Key Size

2048

A+

Subject Info

Common Name

YR1

Organization Name

Let's Encrypt

Country Name

A+

Validity

Not Before

2025-09-03T00:00:00+00:00

Not After

2028-09-02T23:59:59+00:00

n/a

Issuer

Common Name

Root YR

Organization Name

ISRG

Country Name

A+

Fingerprints

MD5

25:70:F7:29:35:C3:E4:D7:4B:EB:4B:23:6F:03:62:CA

SHA1

CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E

SHA2_256

13:94:96:34:D9:9C:D6:FD:6A:A8:0B:C0:34:FE:FA:CC:EB:19:69:FE:EF:98:65:86:71:3E:CD:BB:05:75:8D:3F

A+

Public Key

Key Type

RSA

Key Size

2048

A+

Subject Info

Common Name

Root YR

Organization Name

ISRG

Country Name

A+

Validity

Not Before

2026-05-13T00:00:00+00:00

Not After

2032-09-02T23:59:59+00:00

n/a

Issuer

Common Name

ISRG Root X1

Organization Name

Internet Security Research Group

Country Name

A+

Fingerprints

MD5

FB:C9:11:C7:6E:DD:27:09:38:B9:0D:9E:B3:3B:D9:A0

SHA1

AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98

SHA2_256

07:26:39:D0:B1:40:D5:BF:FA:E1:6A:D9:C3:F6:CC:60:86:04:06:21:F5:1E:E6:1A:6D:46:A8:91:5C:07:CF:76

A+

Public Key

Key Type

RSA

Key Size

4096

A+

Subject Info

Common Name

ISRG Root X1

Organization Name

Internet Security Research Group

Country Name

A+

Validity

Not Before

2015-06-04T11:04:38+00:00

Not After

2035-06-04T11:04:38+00:00

n/a

Issuer

Common Name

ISRG Root X1

Organization Name

Internet Security Research Group

Country Name

A+

Fingerprints

MD5

0C:D2:F9:E0:DA:17:73:E9:ED:86:4D:A5:E3:70:E7:4E

SHA1

CA:BD:2A:79:A1:07:6A:31:F2:1D:25:36:35:CB:03:9D:43:29:A5:E8

SHA2_256

96:BC:EC:06:26:49:76:F3:74:60:77:9A:CF:28:C5:A7:CF:E8:A3:C0:AA:E1:1A:8F:FC:EE:05:C0:BD:DF:08:C6

A+

Public Key

Key Type

RSA

Key Size

4096

n/a

Certificate Transparency

Cloudflare

Cloudflare 'Nimbus2026'

Let's Encrypt

Let's Encrypt 'Sycamore2026h2'

▼

Versions

A+

▼

Highlighted findings

0 total protocol related checks

Congratulations! We could not find any potential issues regarding your server configuration.

▶

Checked facts

2 total protocol related checks

▶

Detailed info

Grade	Enabled Protocol	Findings
A+	TLS 1.3
A+	TLS 1.2