QUALYS SSL LABSのSSL Server Test (https://www.ssllabs.com/ssltest/) は、TLSレイヤのいろいろな脆弱性を検出してくれる便利なツールですが、どういうわけか、診断メッセージの一覧表が見当たらなかったので、以下の表は私が見つけた範囲内での診断メッセージ一覧です。
| 等級 | メッセージ |
|---|---|
| A+ | HTTP Strict Transport Security (HSTS) with long duration deployed on this server. MORE INFO |
| A | Intermediate certificate has a weak signature. Upgrade to SHA2 as soon as possible to avoid browser warnings. MORE INFO |
| A | Certificate has a weak signature and expires after 2015. Upgrade to SHA2 to avoid browser warnings. MORE INFO |
| A- | The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-. MORE INFO |
| A- | There is no support for secure renegotiation. Grade reduced to A-. MORE INFO |
| B | This server accepts RC4 cipher, but only with older protocol versions. Grade capped to B. MORE INFO |
| B | This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B. MORE INFO |
| B | This server uses SSL 3, which is obsolete and insecure. Grade capped to B. MORE INFO |
| B | This server's certificate chain is incomplete. Grade capped to B. |
| C | The server supports only older protocols, but not the current best TLS 1.2. Grade capped to C. MORE INFO |
| C | This server does not mitigate the CRIME attack. Grade capped to C. |
| C | This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C. MORE INFO |
| C | This server uses RC4 with modern protocols. Grade capped to C. |
| F | Experimental: This server is vulnerable to the DROWN attack. Grade set to F. MORE INFO |
| F | This server is vulnerable to MITM attacks because it supports insecure renegotiation. Grade set to F. |
| F | This server is vulnerable to the Heartbleed attack. Grade set to F. |
| F | This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable. Grade set to F. |
| F | This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F. |
| F | This server is vulnerable to the POODLE TLS attack. Patching required. Grade set to F. MORE INFO |
| F | This server supports 512-bit export suites and might be vulnerable to the FREAK attack. Grade set to F. MORE INFO |
| F | This server supports anonymous (insecure) suites (see below for details). Grade set to F. |
| F | This server supports insecure Diffie-Hellman (DH) key exchange parameters (Logjam). Grade set to F. MORE INFO |
| F | This server supports SSL 2, which is obsolete and insecure, and can be used against TLS (DROWN attack). Grade set to F. MORE INFO |
| T | This server's certificate is not trusted, see below for details. |
Q&A
Q. メッセージはこれで全部か。
A. わかりません。あくまで私が見つけたものの一覧なので、抜け漏れはあるかもしれません。
Q. この一覧は最新か。
A. これは、2016年4月～2017年1月くらいの間に私が見つけたものの一覧です。現在は廃止、変更された項目もあるかもしれません。
以上！幸運を祈る。