Dashboard / Security Report

aclu-nj.org

Overall grade based on: IPv4: 1 of 1 complete · IPv6: 0 of 2 complete, 2 not measured

Not measured: no grade for these addresses

2620:12a:8000::2 IPv6 · Not measured: Not scanned: this server address was scanned too often recently (it may be shared by many domains). No grade is given; please try again later.

2620:12a:8001::2 IPv6 · Not measured: Not scanned: this server address was scanned too often recently (it may be shared by many domains). No grade is given; please try again later.

A failed or timed-out measurement says nothing about the server's security, so these addresses are left ungraded. Use the refresh button to try again later.

A+

Exceptional Security

Overall Rating

23.185.0.2 · WHOIS ›

Assessed 2026-11-01 00:55 UTC

Grade Breakdown

Protocol Support 95%

Key Exchange 90%

Cipher Strength 100%

Certificate 100%

Site Access: HTTP and HTTPS

What a visitor typing each address gets, and where its redirects end (up to 5 are followed), as seen from our scanner.

Host	http:// (port 80)	https:// (port 443)
aclu-nj.org	301 → https://www.aclu-nj.org/ → 200 OK	301 → https://www.aclu-nj.org/ → 200 OK
www.aclu-nj.org	301 → https://www.aclu-nj.org/ → 200 OK	200 OK

http://aclu-nj.org redirects to HTTPS.

Certificate Identity

Common Name	aclu-nj.org
Alt Names	aclu-nj.org www.aclu-nj.org
Issuer	CN=YR2, O=Let's Encrypt, C=US
Validity	2026-10-06 to 2027-01-04 (53 days remaining)
Key	RSA 2048 bits (sha256RSA)
Serial Number	06822B4DA08B4564FFF0FD5F4C426827BCE7
SHA256 Fingerprint	f7a1ffa80eaeea9c774b41ad5ebe25f5a09eb7d4556fbfa7bdec052dd59edfd1
Pin SHA256	xJeS/6NFl7GBLoWTFMpC3grDLAA3ec7xFZZ9xsTa2Zc=

Certificate Properties

Type	DV
Cert Transparency	Yes (SCT)
OCSP Must Staple	No
Revocation	Good (not revoked) CRL: http://yr2.c.lencr.org/104.crl No OCSP responder — revocation is published via CRL only (as CA/B Forum rules now allow).
DNS CAA	Yes (configured) 0 iodef "mailto:[email protected]" 0 issue "comodoca.com" 0 issue "digicert.com; cansignhttpexchanges=yes" 0 issue "letsencrypt.org" 0 issue "pki.goog; cansignhttpexchanges=yes" 0 issue "ssl.com" 0 issuewild "comodoca.com" 0 issuewild "digicert.com; cansignhttpexchanges=yes" 0 issuewild "letsencrypt.org" 0 issuewild "pki.goog; cansignhttpexchanges=yes" 0 issuewild "ssl.com"
Trusted By	Yes Mozilla · Apple · Android · Java · Windows
Name Match	Yes
Validity Period	90 days (maximum 200 days for certificates issued then)
Chain Issues	None

Protocol Configuration

Supported Protocols

TLS 1.3

TLS 1.2

TLS 1.1

TLS 1.0

SSL 3

SSL 2

Negotiated Cipher

 TLS_AES_128_GCM_SHA256 

Protocol Details

Connection
ALPN	h2 http/1.1
SNI Required	Yes
Supported Named Groups	X25519MLKEM768 x25519 secp256r1 secp384r1 (server preference order)
Post-Quantum Key Exchange	Yes X25519MLKEM768
HTTP/3 (QUIC)	No
Encrypted Client Hello	No
Security Features
Forward Secrecy	Yes (ECDHE / DHE)
Downgrade Prevention	Yes (legacy TLS disabled)
Secure Renegotiation	Supported (RFC 5746)
Extended Master Secret	Yes (RFC 7627)
OCSP Stapling	No (certificate has no OCSP responder)
HSTS	Yes 0 days max-age below six months: too short for the A+ grade
HSTS Preloading	Not preloadedSubmit →
Security Checks
BEAST attack	Mitigated
POODLE (SSLv3)	No (SSL 3 not supported)
POODLE (TLS)	No
RC4	No
SSL/TLS Compression	No (not supported by .NET TLS stack)
Heartbleed	Not tested

Cipher Suite Analysis

Cipher Suite	Hex	Key Exchange	FS	Bits	Strength
# TLS 1.3 (server-preferred order)
TLS_AES_128_GCM_SHA256	0x1301	ECDHE	FS	128	Secure
TLS_AES_256_GCM_SHA384	0x1302	ECDHE	FS	256	Secure
TLS_CHACHA20_POLY1305_SHA256	0x1303	ECDHE	FS	256	Secure
# TLS 1.2 (server-preferred order)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	0xCCA8	ECDHE	FS	256	Secure
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	0xC02F	ECDHE	FS	128	Secure
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	0xC030	ECDHE	FS	256	Secure

Handshake Simulation

Client	Protocol	Cipher Suite	Result
Chrome 120 / Win 11	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
Chrome 80 / Win 10	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
Firefox 115 / Win 10	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
iOS 17 / Safari	TLS 1.3	TLS_CHACHA20_POLY1305_SHA256	Success
macOS 14 / Safari	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
Android 14	TLS 1.3	TLS_AES_128_GCM_SHA256	Success
Chrome 69 / Win 7	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Chrome 49 / XP SP3	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
IE 11 / Win 10	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
IE 11 / Win 7	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 9.0	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 7.0	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 5.0	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 4.4.2	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Java 11	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Java 8u121	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 4.0.4	-	-	No
Android 4.1.1	-	-	No
Baidu Jan 2015	-	-	No
Java 6	-	-	No

* Simulated based on server's supported protocols and cipher configuration.

Trust Chain Architecture

End-Entity Certificate

CN=aclu-nj.org (Issuer: CN=YR2, O=Let's Encrypt, C=US)

Intermediate CA

CN=YR2, O=Let's Encrypt, C=US (Issuer: CN=Root YR, O=ISRG, C=US)

Intermediate CA

CN=Root YR, O=ISRG, C=US (Issuer: CN=ISRG Root X1, O=Internet Security Research Group, C=US)

Root Certificate

CN=ISRG Root X1, O=Internet Security Research Group, C=US (Issuer: CN=ISRG Root X1, O=Internet Security Research Group, C=US)

TLS History & Relations

Everything our scans have seen for aclu-nj.org, first seen 2026-11-01; current certificate since 2026-11-01.

Certificates served

Certificate (SHA-256)	Issuer	Valid	Served
f7a1ffa80eaeea9c… current	YR2	2026-10-06 → 2027-01-04	2026-11-01

Addresses

Address	Certificate	Seen
23.185.0.2	f7a1ffa80eaeea9c…	2026-11-01

TLS history (a row per change; repeated checks only extend it)

Since → last checked (UTC)	Grade	TLS	Certificates	Addresses
2026-11-01 00:55	A+	TLS 1.3	f7a1ffa80eaeea9c…	23.185.0.2