C-
weak
Protocol
https
Domain
ifppm.org
Checked IP
35.209.241.215
Check Time
2025-02-11T20:38:37+01:00
Cache Time
2025-02-07T15:25:12+00:00

Protocol HTTPS (TLS)

Transport Layer Security (TLS) is a secure data transfer protocol that creates secure communication to leverage higher privacy. Widely used on the Internet, it is the successor of the ancient SSL. Several versions of the protocol are used in applications and services, TLS 1.3 is the most recent, but TLS 1.2 is very common too. Many protocols rely on TLS, for instance, the HTTPS (Hypertext Transfer Protocol Secure) is a security layer over the unencrypted HTTP, but several e-mail protocols (eg: IMAPS, SMTPS, POP3S) use as well to get a secure connection.
▼
Cipher suites
C-
▼
Highlighted findings
C-
Weak Forward Secret Key Exchange Algorithm Preference (non-FS key exchange preferred over FS)
The cipher suite[189][190] key exchange[133] algorithm has no forward secrecy[127][128][129][130] property, but it is preferred over a cipher suite which is forward secret. 
Remove the cipher suite from the list of cipher suites supported by your server or set the cipher suite order explicitly where forward secret cipher suites are preferred over non-forawrd secret ones.
C
Weak Encryption Algorithm (ARIA)
Encryption algorithm ARIA[313][314][315][316] is a block cipher[78][79][80][81] which is considered secure[317], but leading client applications do not use this algorithm. Unless your application or requirements specifically call for their use, it is generally safer to avoid cipher suites that are not adopted and supported by a critical mass of the industry. 
Remove the cipher suite from the list of cipher suites supported by your server.
C
Weak Forward Secrecy (non forward secret algorithm)
Key exchange method has no forward secrecy[127][128][129][130], and does not protect past sessions against future compromises. If long-term secret keys or passwords are compromised, encrypted communications and sessions recorded in the past can be retrieved and decrypted. 
Remove the cipher suite from the list of cipher suites supported by your server.
C
Weak Key Exchange Algorithm (RSA)
RSA[443][444] key exchange is a key exchange[133] that has no forward secrecy[127][128][129][130], and does not protect past sessions against future compromises. If long-term secret keys or passwords are compromised, encrypted communications and sessions recorded in the past can be retrieved and decrypted. Throughout its history RSA encryption has had many security flaws[445][446][447][448][449][450] and was affected by variety of attack types: chosen-ciphertext attack[55] (eg: Bleichenbacher's attack[1][2], ROBOT attack[18][19][20][21]), side-channel attack[69][70][71] (eg: padding oracle attack[63][64][65][66], like Bleichenbacher's cat[3][4][5][6]). 
Always prefer cipher suites with PFS property over the non-PFS ones. Note that performance considerations implies preferring Ephemeral Elliptic-curve Diffie–Hellman[432][433] over Ephemeral Diffie-Hellman[405][406][407][408].
B-
Moderate Authenticated Encryption Preference (CBC preferred over CCM)
The cipher suite[189][190] block cipher mode of operation[82][83][84][85][86] is cipher block chaining[28][29][30] is not an authenticated encryption[74] algorithm, but it is preferred over an authenticated one (counter with CBC-MAC[32][33][34], which provides integrity, and authenticity assurances on the data simultaneously. 
Remove the cipher suite from the list of cipher suites supported by your server or set the cipher suite order explicitly and CCM cipher suites be preferred over CBC ones.
B-
Moderate Authenticated Encryption Preference (CBC preferred over GCM)
The cipher suite[189][190] block cipher mode of operation[82][83][84][85][86] is cipher block chaining[28][29][30] is not an authenticated encryption[74] algorithm, but it is preferred over an authenticated one (Galois/Counter Mode[46][47][48][49], which provides integrity, and authenticity assurances on the data simultaneously. 
Remove the cipher suite from the list of cipher suites supported by your server or set the cipher suite order explicitly and GCM cipher suites be preferred over CBC ones.
B
Moderate Encryption Algorithm (Camellia)
Encryption algorithm Camellia[318][319][320][321] is a block cipher[78][79][80][81] which is considered secure[322][323], but leading client applications do not use this algorithm. Unless your application or requirements specifically call for their use, it is generally safer to avoid cipher suites that are not adopted and supported by a critical mass of the industry. 
Remove the cipher suite from the list of cipher suites supported by your server.
A-
Good MAC Algorithm (SHA-1)
message authentication code[135][136][137][138] is a hashed message authentication code[139][140][141][142][143][144][145] which is considered secure[462], despite the fact that the underlayingcryptographic hash function[94][95][96][97] (Secure Hash Algorithm 1[202][203][204]) is considered insecure[205][206][207][208][209][210][211]. 
If your application or requirements specifically call for the use of a message authentication code[135][136][137][138] that does not provide authenticated encryption[74] prefer block cipher mode of operation[82][83][84][85][86] (eg: counter with CBC-MAC[32][33][34], Galois/Counter Mode[46][47][48][49] or message authentication code[135][136][137][138] (eg: Poly1305[458][459]) that proved authenticated encryption over the ones which does not provide it. In case of a hashed message authentication code[139][140][141][142][143][144][145] prefer message authentication code[135][136][137][138] based on Secure Hash Algorithm 2[212][213][214] over the ones based on Secure Hash Algorithm 1[202][203][204].
A-
Good TLS Cipher Suite Preference (server cipher suites are preferred securely)
Server prefers it's own cipher suite[189][190] order over client's cipher suite preference order. It may cause that less secure cipher suite is choosen in case of an improperly configured client. As not each cipher suite[189][190] supported by the server is considered secure, this is the best possible configuration as long as server's preference order is correct. However it prevents the clients to choose their most preferred cipher suite, which may give them better performance (eg: ChaCha20/Poly1305 ChaCha20-Poly1305[328][329][330]) on mobile devices under the same conditions of security. 
Remove any intermediate or backward compatible cipher suite to make possible preferring client's cipher suite order without any security consideration.
A-
Good TLS Cipher Suite Preference (server cipher suites are preferred unnecessarily)
Each cipher suite[189][190] supported by the server is considered secure, however it prefers its own cipher suite preference order client cipher suite preference order, which prevents the clients to choose their most preferred cipher suite, which may give them better performance (eg: ChaCha20/Poly1305 ChaCha20-Poly1305[328][329][330]) on mobile devices under the same conditions of security. 
Set preference of client cipher suite order.
▶
Checked facts
▶
Detailed info
▼
Key exchange
A
▼
Highlighted findings
Congratulations! We could not find any potential issues regarding your server configuration.
▶
Checked facts
▶
Detailed info
▼
Public keys
A
▼
Highlighted findings
Congratulations! We could not find any potential issues regarding your server configuration.
▶
Checked facts
▶
Detailed info
▼
Versions
A+
▼
Highlighted findings
Congratulations! We could not find any potential issues regarding your server configuration.
▶
Checked facts
▶
Detailed info