Dashboard / Security Report

cam.ac.uk

Overall grade based on: IPv4: 1 of 1 complete · IPv6: 0 of 2 complete, 2 pending — IPv6 results are added below when their scan finishes; they do not count until then.

IPv6 scan in progress

2620:12a:8000::2 IPv6 · Pending: IPv6 scan not started yet (it runs when the report is opened, or via POST /api/ssl-check/{domain}/ipv6).

2620:12a:8001::2 IPv6 · Pending: IPv6 scan not started yet (it runs when the report is opened, or via POST /api/ssl-check/{domain}/ipv6).

The IPv4 report below is complete. IPv6 results will be added to this page automatically when the scan finishes.

A+

Exceptional Security

Overall Rating

23.185.0.2 · WHOIS ›

Assessed 2026-10-08 18:01 UTC

Grade Breakdown

Protocol Support 95%

Key Exchange 90%

Cipher Strength 100%

Certificate 100%

Certificate Identity

Common Name	cam.ac.uk
Alt Names	cam.ac.uk www.cam.ac.uk
Issuer	CN=YR2, O=Let's Encrypt, C=US
Validity	2026-09-25 to 2026-12-24 (58 days remaining)
Key	RSA 2048 bits (sha256RSA)
Serial Number	067E569A42CF8707295ED290D275C111FB52
SHA256 Fingerprint	2efc2068c49da2be124cb3dab99532990a99bed02e48c53ebaed65cb0f925e23
Pin SHA256	xJeS/6NFl7GBLoWTFMpC3grDLAA3ec7xFZZ9xsTa2Zc=

Certificate Properties

Type	DV
Cert Transparency	Yes (SCT)
OCSP Must Staple	No
Revocation	Good (not revoked) CRL: http://yr2.c.lencr.org/83.crl No OCSP responder — revocation is published via CRL only (as CA/B Forum rules now allow).
DNS CAA	No (missing)
Trusted By	Yes Mozilla · Apple · Android · Java · Windows
Name Match	Yes
Validity Period	90 days (maximum 200 days for certificates issued then)
Chain Issues	None

Protocol Configuration

Supported Protocols

TLS 1.3

TLS 1.2

TLS 1.1

TLS 1.0

SSL 3

SSL 2

Negotiated Cipher

 TLS_AES_128_GCM_SHA256 

Protocol Details

Connection
ALPN	h2 http/1.1
SNI Required	Yes
Supported Named Groups	X25519MLKEM768 x25519 secp256r1 secp384r1 (server preference order)
Post-Quantum Key Exchange	Yes X25519MLKEM768
HTTP/3 (QUIC)	No
Encrypted Client Hello	No
Security Features
Forward Secrecy	Yes (ECDHE / DHE)
Downgrade Prevention	Yes (legacy TLS disabled)
Secure Renegotiation	Supported (RFC 5746)
Extended Master Secret	Yes (RFC 7627)
OCSP Stapling	No (certificate has no OCSP responder)
HSTS	Yes 30 days max-age below six months: too short for the A+ grade
HSTS Preloading	Not preloadedSubmit →
Security Checks
BEAST attack	Mitigated
POODLE (SSLv3)	No (SSL 3 not supported)
POODLE (TLS)	No
RC4	No
SSL/TLS Compression	No (not supported by .NET TLS stack)
Heartbleed	Not tested

Cipher Suite Analysis

Cipher Suite	Hex	Key Exchange	FS	Bits	Strength
# TLS 1.3 (server-preferred order)
TLS_AES_128_GCM_SHA256	0x1301	ECDHE	FS	128	Secure
TLS_AES_256_GCM_SHA384	0x1302	ECDHE	FS	256	Secure
TLS_CHACHA20_POLY1305_SHA256	0x1303	ECDHE	FS	256	Secure
# TLS 1.2 (server-preferred order)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	0xCCA8	ECDHE	FS	256	Secure
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	0xC02F	ECDHE	FS	128	Secure
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	0xC030	ECDHE	FS	256	Secure

Handshake Simulation

Client	Protocol	Cipher Suite	Result
Chrome 120 / Win 11	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
Chrome 80 / Win 10	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
Firefox 115 / Win 10	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
iOS 17 / Safari	TLS 1.3	TLS_CHACHA20_POLY1305_SHA256	Success
macOS 14 / Safari	TLS 1.3	TLS_AES_256_GCM_SHA384	Success
Android 14	TLS 1.3	TLS_AES_128_GCM_SHA256	Success
Chrome 69 / Win 7	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Chrome 49 / XP SP3	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
IE 11 / Win 10	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
IE 11 / Win 7	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 9.0	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 7.0	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 5.0	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 4.4.2	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Java 11	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Java 8u121	TLS 1.2	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	Success
Android 4.0.4	-	-	No
Android 4.1.1	-	-	No
Baidu Jan 2015	-	-	No
Java 6	-	-	No

* Simulated based on server's supported protocols and cipher configuration.

Trust Chain Architecture

End-Entity Certificate

CN=cam.ac.uk (Issuer: CN=YR2, O=Let's Encrypt, C=US)

Intermediate CA

CN=YR2, O=Let's Encrypt, C=US (Issuer: CN=Root YR, O=ISRG, C=US)

Intermediate CA

CN=Root YR, O=ISRG, C=US (Issuer: CN=ISRG Root X1, O=Internet Security Research Group, C=US)

Root Certificate

CN=ISRG Root X1, O=Internet Security Research Group, C=US (Issuer: CN=ISRG Root X1, O=Internet Security Research Group, C=US)

TLS History & Relations

Everything our scans have seen for cam.ac.uk, first seen 2026-10-08; current certificate since 2026-10-08.

Certificates served

Certificate (SHA-256)	Issuer	Valid	Served
2efc2068c49da2be… current	YR2	2026-09-25 → 2026-12-24	2026-10-08

Addresses

Address	Certificate	Seen
23.185.0.2	2efc2068c49da2be…	2026-10-08

TLS history (a row per change; repeated checks only extend it)

Since → last checked (UTC)	Grade	TLS	Certificates	Addresses
2026-10-08 18:01	A+	TLS 1.3	2efc2068c49da2be…	23.185.0.2