Check summary
A+
excellent
Protocol
https
Domain
scanigma.com
Checked IP
143.244.197.110
Cache time
2024-03-27T23:41:29+00:00
Check time
2024-03-29T12:38:55+01:00

Protocol HTTPS (TLS)

Transport Layer Security (TLS) is a secure data transfer protocol that creates secure communication to leverage higher privacy. Widely used on the Internet, it is the successor of the ancient SSL. Several versions of the protocol are used in applications and services, TLS 1.3 is the most recent, but TLS 1.2 is very common too. Many protocols rely on TLS, for instance, the HTTPS (Hypertext Transfer Protocol Secure) is a security layer over the unencrypted HTTP, but several e-mail protocols (eg: IMAPS, SMTPS, POP3S) use as well to get a secure connection.
Cipher suites
A+
Highlighted findings
0 total protocol related checks
Congratulations! We could not find any potential issues regarding your server configuration.
Checked facts
14 total protocol related checks
A+
Excellent Block Cipher Mode of Operation (GCM)
block cipher mode of operation[82][83][84][85][86] Galois/Counter Mode[46][47][48][49] is considered secure. It provides authenticated encryption[74] which simultaneously assure the confidentiality[91][92][93] and authenticity[75][76][77] of data.
If your application or requirements specifically call for the use of a message authentication code[135][136][137][138] that does not provide authenticated encryption[74] prefer block cipher mode of operation[82][83][84][85][86] (eg: counter with CBC-MAC[32][33][34], Galois/Counter Mode[46][47][48][49] or message authentication code[135][136][137][138] (eg: Poly1305[458][459]) that proved authenticated encryption over the ones which does not provide it.
A+
Excellent Digital Signature Algorithm (ECDSA)
Elliptic Curve Digital Signature Algorithm[266][267][268][269] is the elliptic-curve cryptography[118][119][120][121] based variant of the digital signature[107][108][109][110] names Digital Signature Algorithm[258][259][260][261][262][263] algorithm. It is considered secure [270][271] and gives better performance and smaller key sizes.
A+
Excellent Digital Signature Algorithm (RSA)
Rivest–Shamir–Adleman[275][276][277] is a digital signature[107][108][109][110] algorithm, which is considered secure, however there are known weaknesses[278][279][280][281][282].
A+
Excellent Encryption Algorithm (AES)
Encryption algorithm Advanced Encryption Standard[302][303][304][305][306][307][308][309] is a block cipher[78][79][80][81] for which there is no known practical attack that would allow the attacker to recover the encrypted text without knowledge of the key when the algorithm is implemented correctly. However improper implementations may lead to a side-channel attack[69][70][71] as it has happened in case of OpenSSL[395][396] [310][311][312].
Prefer cipher suites with greater key size of AES (eg: perfer AES-256 over AES-128).
A+
Excellent Encryption Algorithm (ChaCha20)
The stream cipher[182][183] ChaCha20[324][325][326][327] is a variant of the algorithm Salsa20[380][381][382] is considered secure [331][332] and gives better performance for mobile devices.
Prefer stream cipher[182][183] ChaCha20[324][325][326][327] in case of mobile devices.
A+
Excellent Encryption Block Size (encryption block size > 64 bits)
The block cipher[78][79][80][81] uses a block size[87] larger than 64 bits, so it is not vulnerable to sweet32 attack[22][23][24][25].
A+
Excellent Encryption Block Size (encryption key size ≥ 128 bits)
The symmetric key[185][186][187] withkey size[184] more than 128 bits as it is should be according to National Institute of Standards and Technology[470][471] so it is not vulnerable to preimage attack[67] and it cannreliably prove that message came from the stated sender (its authenticity) and has not been changed, so connection is not open for a man-in-the-middle attack[61].
Remove the cipher suite from the list of cipher suites supported by your server.
A+
Excellent Authenticated Encryption (authenticated encryption)
Encryption mode is an authenticated encryption[74] which provides confidentiality[91][92][93], integrity, and authenticity assurances on the data.
A+
Excellent Key Exchange Algorithm (ECDHE)
Ephemeral Elliptic-curve Diffie–Hellman[432][433] is a variant of Elliptic-curve Diffie–Hellman[114][115] key exchange that has forward secrecy[127][128][129][130], and does protect past sessions against future compromises. If long-term secret keys or passwords are compromised, encrypted communications and sessions recorded in the past cannot be retrieved and decrypted.
Always prefer cipher suites with PFS property over the non-PFS ones. Note that performance considerations implies preferring Ephemeral Elliptic-curve Diffie–Hellman[432][433] over Ephemeral Diffie-Hellman[405][406][407][408].
A+
Excellent Forward Secrecy (forward secret algorithm)
Key exchange method has forward secrecy[127][128][129][130], and does protect past sessions against future compromises. If long-term secret keys or passwords are compromised, encrypted communications and sessions recorded in the past cannot be retrieved and decrypted.
Always prefer cipher suites with FS property over the non-FS ones.
A+
Excellent MAC Algorithm (Poly1305)
message authentication code[135][136][137][138] is a message authentication code based on universal hashing[150][151][152][153] which is considered secure. It provides authenticated encryption[74] which simultaneously assure the confidentiality[91][92][93] and authenticity[75][76][77] of data. Together with stream cipher[182][183] ChaCha20ChaCha20-Poly1305[328][329][330] gives better performance on mobile devices under the same conditions of security.
If your application or requirements specifically call for the use of a message authentication code[135][136][137][138] that does not provide authenticated encryption[74] prefer block cipher mode of operation[82][83][84][85][86] (eg: counter with CBC-MAC[32][33][34], Galois/Counter Mode[46][47][48][49] or message authentication code[135][136][137][138] (eg: Poly1305[458][459]) that proved authenticated encryption over the ones which does not provide it. In case of a hashed message authentication code[139][140][141][142][143][144][145] prefer message authentication code[135][136][137][138] based on Secure Hash Algorithm 2[212][213][214] over the ones based on Secure Hash Algorithm 1[202][203][204].
A+
Excellent MAC Algorithm (SHA-2)
message authentication code[135][136][137][138] is a hashed message authentication code[139][140][141][142][143][144][145] which is considered secure. The underlaying cryptographic hash function[94][95][96][97] (Secure Hash Algorithm 2[212][213][214]) is also considered secure.
If your application or requirements specifically call for the use of a message authentication code[135][136][137][138] that does not provide authenticated encryption[74] prefer block cipher mode of operation[82][83][84][85][86] (eg: counter with CBC-MAC[32][33][34], Galois/Counter Mode[46][47][48][49] or message authentication code[135][136][137][138] (eg: Poly1305[458][459]) that proved authenticated encryption over the ones which does not provide it. In case of a hashed message authentication code[139][140][141][142][143][144][145] prefer message authentication code[135][136][137][138] based on Secure Hash Algorithm 2[212][213][214] over the ones based on Secure Hash Algorithm 1[202][203][204].
A+
Excellent TLS Cipher Suite Preference (client cipher suites are preferred)
Server prefers client's cipher suite[189][190] order over its own cipher suite preference order. It may cause that less secure cipher suite is choosen in case of an improperly configured client, only if server supports less secure cipher suites. However it allows the clients to choose their most preferred cipher suite, which may give them better performance (eg: ChaCha20/Poly1305 ChaCha20-Poly1305[328][329][330]) on mobile devices under the same conditions of security.
Remove any intermediate or backward compatible cipher suite to make possible preferring client's cipher suite order without any security consideration.
A+
Excellent TLS Cipher Suite Preference (client cipher suites are preferred securely)
Server prefers client's cipher suite[189][190] order over its own cipher suite preference order. As each cipher suite[189][190] supported by the server is considered secure, this is the best configuration. It allows the clients to choose their most preferred cipher suite, which may give them better performance (eg: ChaCha20/Poly1305 ChaCha20-Poly1305[328][329][330]) on mobile devices under the same conditions of security.
Detailed info
TLS 1.2
Grade Order Identifier Findings
A+
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
A+
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
A+
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
A+
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
A+
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
A+
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS 1.3
Grade Order Identifier Findings
A+
TLS_AES_128_GCM_SHA256
A+
TLS_AES_256_GCM_SHA384
A+
TLS_CHACHA20_POLY1305_SHA256
Key exchange
A
Highlighted findings
0 total protocol related checks
Congratulations! We could not find any potential issues regarding your server configuration.
Checked facts
3 total protocol related checks
A
Good Elliptic Curve Algorithm (elliptic curve designed by NIST)
The elliptic-curve cryptography[118][119][120][121] is an approach to public-key cryptography[164][165][166] based on the elliptic curve[116][117]s. Note that there is controversy[287][288][289][290][291] around the National Institute of Standards and Technology[470][471] designed elliptic curveselliptic curve designed by NIST[285][286].
Add at least one elliptic curve to the list of elliptic curves supported by your server designed by independent researchers and prefer them as server configuration makes it possibel.
A+
Excellent Elliptic Curve Algorithm (elliptic curve designed by independent researcher)
The elliptic-curve cryptography[118][119][120][121] is an approach to public-key cryptography[164][165][166] based on the elliptic curve[116][117]s. Note that there is controversy[287][288][289][290][291] around the National Institute of Standards and Technology[470][471] designed elliptic curveselliptic curve designed by NIST[285][286]. This elliptic curve designed by independent researcher[284] Daniel J. Bernstein[476][477] and there is no evidence for any compromise.
Add at least one elliptic curve to the list of elliptic curves supported by your server designed by independent researchers and prefer them as server configuration makes it possibel.
A+
Excellent Elliptic Curve Algorithm (elliptic curve key size)
The elliptic-curve cryptography[118][119][120][121] is an approach to public-key cryptography[164][165][166] based on the elliptic curve[116][117]s. The most important property in terms of encryption strength, beyond the designer is elliptic curve key size[292][293][294]. All the key sizes available are considered secure, so there is no consideration about it.
Detailed info
Curves
Grade Name Code Key Size Trusted Designer Findings
A
prime256v1 0x0017 256 No
A
secp384r1 0x0018 384 No
A
secp521r1 0x0019 521 No
A+
Curve25519 0x001D 256 Yes
A+
Curve448 0x001E 448 Yes
Public keys
A
Highlighted findings
0 total protocol related checks
Congratulations! We could not find any potential issues regarding your server configuration.
Checked facts
13 total protocol related checks
A
Good X.509 Public Key Subject (common name does not match)
A digital certificate[104][105] must contain a field called subject[509][510] and may contain certificate extensions[506][507][508] including subject alternative name extension[502][503][504]. During the hostname validation[514][515] client applications (eg: browser, email client, ...) match common name[511][512][513] part of the subject and values of subject alternative names against the domain name[112][113] of the connected server. Either the value of the common name attribute or one of the values of subject alternative name extension should match to the domain name exactly at least by a wildcard character[191][192] in case of a wildcrard certificate[551][552][553][554]. The certificate provided by your server contains common names, but neither of its values matches the domain name.
Ensure that one of the values of the subject alternative names extension of the certificate provided by your server matches to the domain name. Consider the fact that old client (eg: browsers released before 2003) may not support[505] the subject alternative names extension.
A
Good X.509 Public Key Subject (subject alternative names do not match)
A digital certificate[104][105] must contain a field called subject[509][510] and may contain certificate extensions[506][507][508] including subject alternative name extension[502][503][504]. During the hostname validation[514][515] client applications (eg: browser, email client, ...) match common name[511][512][513] part of the subject and values of subject alternative names against the domain name[112][113] of the connected server. Either the value of the common name attribute or one of the values of subject alternative name extension should match to the domain name exactly at least by a wildcard character[191][192] in case of a wildcrard certificate[551][552][553][554]. The certificate provided by your server contains subject alternative name extension, but neither of its values matches the domain name.
Ensure the common name part of the subject field of the certificate provided by your server matches to the domain name.
A+
Excellent Digital Signature Algorithm (ECDSA)
Elliptic Curve Digital Signature Algorithm[266][267][268][269] is the elliptic-curve cryptography[118][119][120][121] based variant of the digital signature[107][108][109][110] names Digital Signature Algorithm[258][259][260][261][262][263] algorithm. It is considered secure [270][271] and gives better performance and smaller key sizes.
A+
Excellent Digital Signature Algorithm (RSA)
Rivest–Shamir–Adleman[275][276][277] is a digital signature[107][108][109][110] algorithm, which is considered secure, however there are known weaknesses[278][279][280][281][282].
A+
Excellent Public Key Size (ECDSA with key size ≥ 224)
The asymmetric key size[53] in cryptography defines the upper-bound on an algorithm's security. The Elliptic Curve Digital Signature Algorithm[266][267][268][269] is a digital signature[107][108][109][110]. The ECDSA keys with size greater than or equal to 224 bits are considered secure according to National Institute of Standards and Technology[470][471].
A+
Excellent Public Key Size (RSA with key size ≤ 2048)
The asymmetric key size[53] in cryptography defines the upper-bound on an algorithm's security. The Rivest–Shamir–Adleman cryptosystem[478][479][480] is a cryptosystem, which provides both key distribution[131], digital signature[107][108][109][110]. The RSA keys with size greater than or equal to 2048 bits are considered secure according to National Institute of Standards and Technology[470][471].
A+
Excellent X.509 Public Key Subject (common name does not match)
A digital certificate[104][105] must contain a field called subject[509][510] and may contain certificate extensions[506][507][508] including subject alternative name extension[502][503][504]. During the hostname validation[514][515] client applications (eg: browser, email client, ...) match common name[511][512][513] part of the subject and values of subject alternative names against the domain name[112][113] of the connected server. Either the value of the common name attribute or one of the values of subject alternative name extension should match to the domain name exactly at least by a wildcard character[191][192] in case of a wildcrard certificate[551][552][553][554]. The certificate provided by your server contains common names and its values matches the domain name.
A+
Excellent Public Key Revocation Check (OCSP stapling supported)
Server supports revocation check mechanism Online Certificate Status Protocol (OCSP) stapling[527][528][529][530][531]. Revocation check mechanisms of X.509 public key[493][494][495][496][497] certificates have many flaws [518][519][520][521] and now, the only practically working and used vendor independent mechanisms is OCSP stapling.Without using a certificate revocation check mechanism a client applications (eg: browser, email client, ...), cannot determine whether X.509 public key the server provides still valid or it has already been revoked by the issuer of the certificate. Without this information it cannot be reliably proved that message caomes from the stated sender (its authenticity) or it has been changed, so connections could be open for a man-in-the-middle attack[61].
Always chose certificate authority[88][89][90]s which support Online Certificate Status Protocol (OCSP)[522][523][524][525][526]. Prefer server implementations which support Online Certificate Status Protocol (OCSP) stapling[527][528][529][530][531] or use a proxy application make up for this shortcomings.
A+
Excellent Public Key Signature Hash Algorithm (root CA signature algorithm)
A digital certificate[104][105] which identifies a site can be signed by a certificate authority[88][89][90] or can be a self-signed certificate[111] (root certificate[106]) having a digital signature[107][108][109][110] in both cases, however it is needless to be verified in the latter case, so the security of the used cryptographic hash function[94][95][96][97] does not matter.
A+
Excellent X.509 Public Key Subject (subject alternative names do match)
A digital certificate[104][105] must contain a field called subject[509][510] and may contain certificate extensions[506][507][508] including subject alternative name extension[502][503][504]. During the hostname validation[514][515] client applications (eg: browser, email client, ...) match common name[511][512][513] part of the subject and values of subject alternative names against the domain name[112][113] of the connected server. Either the value of the common name attribute or one of the values of subject alternative name extension should match to the domain name exactly at least by a wildcard character[191][192] in case of a wildcrard certificate[551][552][553][554]. The certificate provided by your server contains subject alternative name extension and one of its values matches the domain name.
A+
Excellent X.509 Public Key Validation (domain-validated certificate)
The digital certificate[104][105] identifies the site is a domain-validated certificate[536], means that verification of the control over a DNS domain was required by the certificate authority[88][89][90] to sign this certificate.
Take into consideration the advantages of a domain-validated certificate[536] (eg: completely automated certificate renewal[516][517] process, possibly short validation period[518][519][520][521]) over minor user experience improvement of an extended validation in certain client applications and the risk of a potential service outage caused by the manual certificate renewal[541][542].
A+
Excellent X.509 Public Key Validity (certficate is valid)
A digital certificate[104][105] identifies a site is signed by a certificate authority[88][89][90] certifies the ownership of a public key within a limited time period, called validity[543][544][545]. The current date and time is within the validity period of the public key provided by your server.
Restore the certificate, provided by your server, to the latest one, if it is available and its validity period has not ended yet, or initiate renewal[516][517] process if its validity period has ended yet. If there no available certificate create a completely new one and get is signed with a certificate authority.
A+
Excellent Public Key Signature Hash Algorithm (SHA-2)
The digital certificate[104][105] which identifies the site is signed by a certificate authority[88][89][90] having digital signature[107][108][109][110] with signature hash algorithm SHA-2[565] which uses Secure Hash Algorithm 2[212][213][214] as cryptographic hash function[94][95][96][97] considered secure.
Always provide certificate by your server to use signature algorithms with hash functions that are strong just like SHA-2 signature algorithms.
Detailed info
A+
Server Certificate
scanigma.com
+0 alternative name(s)
Valid From: 2024-01-01T23:24:53+00:00
Valid Until: 2024-03-31T23:24:52+00:00
A+
Intermediate CA
R3
2020-09-04
2025-09-15
A+
Root CA
ISRG Root X1
2015-06-04
2035-06-04
A+
Subject Info
Common Names
scanigma.com
Subject Alternative Names
scanigma.com
A+
Validity
Not Before
2024-01-01T23:24:53+00:00
Not After
2024-03-31T23:24:52+00:00
N/A
Issuer
Common Name
R3
Organization Name
Let's Encrypt
Country Name
US
A+
Fingerprints
MD5
A3:A6:79:87:66:3B:BD:B6:21:A4:F6:FA:2F:45:F9:52
SHA1
74:36:21:90:2B:DF:1C:40:77:F3:73:BF:50:16:97:67:51:D7:0F:60
SHA2_256
A6:AA:97:22:46:D0:65:B9:33:DC:28:66:A1:EE:33:11:D5:D5:45:31:EA:B3:D6:40:FB:75:93:76:9E:36:EE:A0
A+
Public Key
Key Type
RSA
Key Size
3072
A+
Subject Info
Common Name
R3
Organization Name
Let's Encrypt
Country Name
US
A+
Validity
Not Before
2020-09-04T00:00:00+00:00
Not After
2025-09-15T16:00:00+00:00
N/A
Issuer
Common Name
ISRG Root X1
Organization Name
Internet Security Research Group
Country Name
US
A+
Fingerprints
MD5
E8:29:E6:5D:7C:43:07:D6:FB:C1:3C:17:9E:03:7A:36
SHA1
A0:53:37:5B:FE:84:E8:B7:48:78:2C:7C:EE:15:82:7A:6A:F5:A4:05
SHA2_256
67:AD:D1:16:6B:02:0A:E6:1B:8F:5F:C9:68:13:C0:4C:2A:A5:89:96:07:96:86:55:72:A3:C7:E7:37:61:3D:FD
A+
Public Key
Key Type
RSA
Key Size
2048
A+
Subject Info
Common Name
ISRG Root X1
Organization Name
Internet Security Research Group
Country Name
US
A+
Validity
Not Before
2015-06-04T11:04:38+00:00
Not After
2035-06-04T11:04:38+00:00
N/A
Issuer
Common Name
ISRG Root X1
Organization Name
Internet Security Research Group
Country Name
US
A+
Fingerprints
MD5
0C:D2:F9:E0:DA:17:73:E9:ED:86:4D:A5:E3:70:E7:4E
SHA1
CA:BD:2A:79:A1:07:6A:31:F2:1D:25:36:35:CB:03:9D:43:29:A5:E8
SHA2_256
96:BC:EC:06:26:49:76:F3:74:60:77:9A:CF:28:C5:A7:CF:E8:A3:C0:AA:E1:1A:8F:FC:EE:05:C0:BD:DF:08:C6
A+
Public Key
Key Type
RSA
Key Size
4096
A
Server Certificate
scanigma.com
+0 alternative name(s)
Valid From: 2024-01-01T23:24:59+00:00
Valid Until: 2024-03-31T23:24:58+00:00
A+
Intermediate CA
R3
2020-09-04
2025-09-15
A+
Root CA
ISRG Root X1
2015-06-04
2035-06-04
A
Subject Info
Common Names
scanigma.com
Subject Alternative Names
scanigma.com
A+
Validity
Not Before
2024-01-01T23:24:59+00:00
Not After
2024-03-31T23:24:58+00:00
N/A
Issuer
Common Name
R3
Organization Name
Let's Encrypt
Country Name
US
A+
Fingerprints
MD5
53:D4:F9:E7:E6:AA:16:6D:B0:3D:55:90:1F:78:1A:53
SHA1
40:16:AB:7A:33:A3:EA:B6:1B:1A:1B:24:24:37:B2:7D:99:91:E8:8E
SHA2_256
E3:E0:B1:15:BE:7F:E6:38:43:5D:0A:55:69:BD:5D:CD:F0:71:86:E2:9A:EC:EE:30:8F:73:3C:E4:EF:1B:1D:19
A+
Public Key
Key Type
ECDSA
Key Size
256
A+
Subject Info
Common Name
R3
Organization Name
Let's Encrypt
Country Name
US
A+
Validity
Not Before
2020-09-04T00:00:00+00:00
Not After
2025-09-15T16:00:00+00:00
N/A
Issuer
Common Name
ISRG Root X1
Organization Name
Internet Security Research Group
Country Name
US
A+
Fingerprints
MD5
E8:29:E6:5D:7C:43:07:D6:FB:C1:3C:17:9E:03:7A:36
SHA1
A0:53:37:5B:FE:84:E8:B7:48:78:2C:7C:EE:15:82:7A:6A:F5:A4:05
SHA2_256
67:AD:D1:16:6B:02:0A:E6:1B:8F:5F:C9:68:13:C0:4C:2A:A5:89:96:07:96:86:55:72:A3:C7:E7:37:61:3D:FD
A+
Public Key
Key Type
RSA
Key Size
2048
A+
Subject Info
Common Name
ISRG Root X1
Organization Name
Internet Security Research Group
Country Name
US
A+
Validity
Not Before
2015-06-04T11:04:38+00:00
Not After
2035-06-04T11:04:38+00:00
N/A
Issuer
Common Name
ISRG Root X1
Organization Name
Internet Security Research Group
Country Name
US
A+
Fingerprints
MD5
0C:D2:F9:E0:DA:17:73:E9:ED:86:4D:A5:E3:70:E7:4E
SHA1
CA:BD:2A:79:A1:07:6A:31:F2:1D:25:36:35:CB:03:9D:43:29:A5:E8
SHA2_256
96:BC:EC:06:26:49:76:F3:74:60:77:9A:CF:28:C5:A7:CF:E8:A3:C0:AA:E1:1A:8F:FC:EE:05:C0:BD:DF:08:C6
A+
Public Key
Key Type
RSA
Key Size
4096
Versions
A+
Highlighted findings
0 total protocol related checks
Congratulations! We could not find any potential issues regarding your server configuration.
Checked facts
2 total protocol related checks
A+
Excellent TLS/SSL Protocol Version (TLS 1.2)
The Transport Layer Security 1.2[239][240] or later versions are currently the suggested TLS versions, compared to the early TLS versions[250][251][252][253][254] which are considered deprecated. Payment Card Industry Security Standards Council[472][473] suggests that organizations migrate from Transport Layer Security 1.0[235][236] to Transport Layer Security 1.1[237][238] or higher before June 30, 2018. In October 2018, Apple, Google, Microsoft, and Mozilla jointly announced they would deprecate TLS 1.0 and 1.1 in March 2020.
Add the Transport Layer Security 1.3[241][242][243][244][245][246][247] to the list of TLS versions accepted by your server.
A+
Excellent TLS/SSL Protocol Version (TLS 1.3)
The Transport Layer Security 1.3[241][242][243][244][245][246][247] is the latest version of Transport Layer Security[234]. It is considered faster an more secure than the eralier versions as weak and lesser-used elliptic curve[116][117]s and cryptographic hash function[94][95][96][97] algorithms were removed. Also key exchange[133] algorithms that does not support authenticated encryption[74] or forward secrecy[127][128][129][130] were removed and round-trip delay time[175] is decreased.
Detailed info
Grade Enabled Protocol
A+
TLS 1.3
A+
TLS 1.2