icann.org
Overall grade based on: IPv4: 1 of 1 complete · IPv6: 0 of 1 complete, 1 pending — IPv6 results are added below when their scan finishes; they do not count until then.
IPv6 scan in progress
2001:500:88:200::7 IPv6 · Pending: IPv6 scan not started yet (it runs when the report is opened, or via POST /api/ssl-check/{domain}/ipv6).
The IPv4 report below is complete. IPv6 results will be added to this page automatically when the scan finishes.
Grade Breakdown
Protocol Support 95%
Key Exchange 100%
Cipher Strength 100%
Certificate 100%
Certificate Identity
| Common Name | icann.org |
| Alt Names | *.icann.org icann.org |
| Issuer | CN=Sectigo Public Server Authentication CA OV R36, O=Sectigo Limited, C=GB |
| Validity | 2025-12-06 to 2027-01-05 (60 days remaining) |
| Key | RSA 4096 bits (sha256RSA) |
| Serial Number | 00E37D01B8DF6704734F5B2D3FE0AEB9F0 |
| SHA256 Fingerprint | 2435d2a77b552348c784d841f052a24b98d718f9d3f50d3fcf2810dc59d29c4b |
| Pin SHA256 | rOTKi8Bj8Z3XmRSdsOBqDt2pf5vZZ3davIEk9g3zRo0= |
Certificate Properties
| Type | OV |
| Cert Transparency | Yes (SCT) |
| OCSP Must Staple | No |
| Revocation | Unknown (CRL could not be downloaded) OCSP: http://ocsp.sectigo.com CRL: http://crl.sectigo.com/SectigoPublicServerAuthenticationCAOVR36.crl |
| DNS CAA | Yes (configured) 0 iodef "mailto:[email protected]" 0 issue "amazon.com" 0 issue "godaddy.com" 0 issue "letsencrypt.org" 0 issue "pki.goog" 0 issue "sectigo.com" 0 issuemail "sectigo.com" 0 issuewild "amazon.com" 0 issuewild "letsencrypt.org" 0 issuewild "sectigo.com" |
| Trusted By | Yes Mozilla · Apple · Android · Java · Windows |
| Name Match | Yes |
| Validity Period | 396 days (maximum 398 days for certificates issued then) |
| Chain Issues | None |
Protocol Configuration
Supported Protocols
TLS 1.3
TLS 1.2
TLS 1.1
TLS 1.0
SSL 3
SSL 2
Negotiated Cipher
TLS_AES_256_GCM_SHA384
Protocol Details
| Connection | |
| ALPN | No |
| SNI Required | No |
| Supported Named Groups | secp384r1 secp256r1 x25519 (server preference order) |
| Post-Quantum Key Exchange | No (no hybrid ML-KEM group such as X25519MLKEM768) |
| HTTP/3 (QUIC) | Unknown |
| Encrypted Client Hello | Unknown |
| Security Features | |
| Forward Secrecy | Yes (ECDHE / DHE) |
| Downgrade Prevention | Yes (legacy TLS disabled) |
| Secure Renegotiation | Supported (RFC 5746) |
| Extended Master Secret | Yes (RFC 7627) |
| OCSP Stapling | No |
| HSTS | Yes 558 days · preload |
| HSTS Preloading | Not preloadedSubmit → |
| Security Checks | |
| BEAST attack | Mitigated |
| POODLE (SSLv3) | No (SSL 3 not supported) |
| POODLE (TLS) | No |
| RC4 | No |
| SSL/TLS Compression | No (not supported by .NET TLS stack) |
| Heartbleed | Not tested |
Cipher Suite Analysis
| Cipher Suite | Hex | Key Exchange | FS | Bits | Strength |
|---|---|---|---|---|---|
| # TLS 1.3 (server-preferred order) | |||||
| TLS_AES_256_GCM_SHA384 | 0x1302 | ECDHE | FS | 256 | Secure |
| TLS_CHACHA20_POLY1305_SHA256 | 0x1303 | ECDHE | FS | 256 | Secure |
| TLS_AES_128_GCM_SHA256 | 0x1301 | ECDHE | FS | 128 | Secure |
| # TLS 1.2 (server-preferred order) | |||||
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | 0xCCA8 | ECDHE | FS | 256 | Secure |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | 0xC030 | ECDHE | FS | 256 | Secure |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | 0xC014 | ECDHE | FS | 256 | Weak |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 0xC028 | ECDHE | FS | 256 | Weak |
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | 0xC02F | ECDHE | FS | 128 | Secure |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | 0xC013 | ECDHE | FS | 128 | Weak |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | 0xC027 | ECDHE | FS | 128 | Weak |
Handshake Simulation
| Client | Protocol | Cipher Suite | Result |
|---|---|---|---|
| Chrome 120 / Win 11 | TLS 1.3 | TLS_AES_256_GCM_SHA384 | Success |
| Chrome 80 / Win 10 | TLS 1.3 | TLS_AES_256_GCM_SHA384 | Success |
| Firefox 115 / Win 10 | TLS 1.3 | TLS_AES_256_GCM_SHA384 | Success |
| iOS 17 / Safari | TLS 1.3 | TLS_CHACHA20_POLY1305_SHA256 | Success |
| macOS 14 / Safari | TLS 1.3 | TLS_AES_256_GCM_SHA384 | Success |
| Android 14 | TLS 1.3 | TLS_AES_128_GCM_SHA256 | Success |
| Chrome 69 / Win 7 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Chrome 49 / XP SP3 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| IE 11 / Win 10 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| IE 11 / Win 7 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Android 9.0 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Android 7.0 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Android 5.0 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Android 4.4.2 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Java 11 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Java 8u121 | TLS 1.2 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Success |
| Android 4.0.4 | - | - | No |
| Android 4.1.1 | - | - | No |
| Baidu Jan 2015 | - | - | No |
| Java 6 | - | - | No |
* Simulated based on server's supported protocols and cipher configuration.
Trust Chain Architecture
End-Entity Certificate
CN=*.icann.org, O=Internet Corporation For Assigned Names and Numbers, S=California, C=US (Issuer: CN=Sectigo Public Server Authentication CA OV R36, O=Sectigo Limited, C=GB)
Intermediate CA
CN=Sectigo Public Server Authentication CA OV R36, O=Sectigo Limited, C=GB (Issuer: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB)
Root Certificate
CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB (Issuer: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB)
TLS History & Relations
Everything our scans have seen for icann.org, first seen 2026-09-27; current certificate since 2026-09-27.
Certificates served
| Certificate (SHA-256) | Issuer | Valid | Served |
|---|---|---|---|
| 2435d2a77b552348… current | Sectigo Public Server Authentication CA OV R36 | 2025-12-06 → 2027-01-05 | 2026-09-27 |
Addresses
| Address | Certificate | Seen |
|---|---|---|
| 192.0.43.7 | 2435d2a77b552348… | 2026-09-27 |
TLS history (a row per change; repeated checks only extend it)
| Since → last checked (UTC) | Grade | TLS | Certificates | Addresses |
|---|---|---|---|---|
| 2026-09-27 04:22 | A+ | TLS 1.3 | 2435d2a77b552348… | 192.0.43.7 |