www.gandi.net
Overall grade based on: IPv4: 4 of 4 complete · IPv6: 4 of 4 complete
2 different configurations detected across 8 endpoints Select an IP for owner, ASN & location
Grade Breakdown
Protocol Support 90%
Key Exchange 90%
Cipher Strength 100%
Certificate 100%
Protocol Configuration
Supported Protocols
TLS 1.3
TLS 1.2
TLS 1.1
TLS 1.0
SSL 3
SSL 2
Negotiated Cipher
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Protocol Details
| Connection | |
| ALPN | No |
| SNI Required | Yes |
| Supported Named Groups | secp256r1 (inferred) |
| Post-Quantum Key Exchange | Unknown |
| HTTP/3 (QUIC) | Unknown |
| Encrypted Client Hello | Unknown |
| Security Features | |
| Forward Secrecy | Yes (ECDHE / DHE) |
| Downgrade Prevention | Yes (legacy TLS disabled) |
| Secure Renegotiation | Unknown |
| Extended Master Secret | Unknown |
| OCSP Stapling | Unknown (measured on TLS 1.2 only) |
| HSTS | Yes |
| HSTS Preloading | Not preloadedSubmit → |
| Security Checks | |
| BEAST attack | Mitigated |
| POODLE (SSLv3) | No (SSL 3 not supported) |
| POODLE (TLS) | No |
| RC4 | No |
| SSL/TLS Compression | No (not supported by .NET TLS stack) |
| Heartbleed | Not tested |
Cipher Suite Analysis
| Cipher Suite | Hex | Key Exchange | FS | Bits | Strength |
|---|---|---|---|---|---|
| # TLS 1.2 | |||||
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | 0xC02F | ECDH secp256r1 (eq. 3072 bits RSA) | FS | 128 | Secure |
Handshake Simulation
| Client | Protocol | Cipher Suite | Result |
|---|---|---|---|
| Chrome 120 / Win 11 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| Chrome 80 / Win 10 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| Firefox 115 / Win 10 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| iOS 17 / Safari | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| macOS 14 / Safari | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| Android 14 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| Chrome 69 / Win 7 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| Chrome 49 / XP SP3 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| IE 11 / Win 10 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| IE 11 / Win 7 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| Android 9.0 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| Android 7.0 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| Android 5.0 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| Android 4.4.2 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| Java 11 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Success |
| Java 8u121 | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Success |
| Android 4.0.4 | - | - | No |
| Android 4.1.1 | - | - | No |
| Baidu Jan 2015 | - | - | No |
| Java 6 | - | - | No |
* Simulated based on server's supported protocols and cipher configuration.
Certificate Identity
| Common Name | www.gandi.net |
| Alt Names | www.gandi.net gandi.net |
| Issuer | CN=Gandi RSA Domain Validation Secure Server CA 4, O=Gandi, C=FR |
| Validity | 2026-06-11 to 2026-12-26 (49 days remaining) |
| Key | RSA 2048 bits (sha256RSA) |
| Serial Number | 00E02AC6FDA033E3125F6C6A6F05770F70 |
| SHA256 Fingerprint | 2d8a176643fc89950d8dc692aa963bc5657fa2b1d0b507f365c7d047aa3dba71 |
| Pin SHA256 | 5bKx3p65TJoeb7X1gdm0fdg6RD8fpC1bkhwC7QY+0ec= |
Certificate Properties
| Type | DV |
| Cert Transparency | Yes (SCT) |
| OCSP Must Staple | No |
| Revocation | Good (not revoked) OCSP: http://crt.sectigo.com/GandiRSADomainValidationSecureServerCA4.crt |
| DNS CAA | No (missing) |
| Trusted By | Yes Mozilla · Apple · Android · Java · Windows |
| Validity Period | 199 days (maximum 200 days for certificates issued then) |
| Chain Issues | • Contains anchor (root CA included in chain) |
Trust Chain Architecture
End-Entity Certificate
CN=www.gandi.net (Issuer: CN=Gandi RSA Domain Validation Secure Server CA 4, O=Gandi, C=FR)
Intermediate CA
CN=Gandi RSA Domain Validation Secure Server CA 4, O=Gandi, C=FR (Issuer: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB)
Root Certificate
CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB (Issuer: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB)
TLS History & Relations
Everything our scans have seen for www.gandi.net, first seen 2026-04-13; current certificate since 2026-09-22.
Certificates served
| Certificate (SHA-256) | Issuer | Valid | Served |
|---|---|---|---|
| 2d8a176643fc8995… current | Gandi RSA Domain Validation Secure Server CA 4 | 2026-06-11 → 2026-12-26 | 2026-09-22 |
Addresses
| Address | Certificate | Seen |
|---|---|---|
| 151.101.1.103 | 2d8a176643fc8995… | 2026-09-22 |
| 151.101.65.103 | 2d8a176643fc8995… | 2026-09-22 |
| 151.101.129.103 | 2d8a176643fc8995… | 2026-09-22 |
| 151.101.193.103 | 2d8a176643fc8995… | 2026-09-22 |
| 2a04:4e42::359 | 2d8a176643fc8995… | 2026-09-22 |
| 2a04:4e42:200::359 | 2d8a176643fc8995… | 2026-09-22 |
| 2a04:4e42:400::359 | 2d8a176643fc8995… | 2026-09-22 |
| 2a04:4e42:600::359 | 2d8a176643fc8995… | 2026-09-22 |
TLS history (a row per change; repeated checks only extend it)
| Since → last checked (UTC) | Grade | TLS | Certificates | Addresses |
|---|---|---|---|---|
| 2026-09-22 10:42 | A+ | TLS 1.2 | 2d8a176643fc8995… | 151.101.1.103, 151.101.65.103, 151.101.129.103, 151.101.193.103, 2a04:4e42::359, 2a04:4e42:200::359, 2a04:4e42:400::359, 2a04:4e42:600::359 |