This application checks a DANE TLS Service. It connects to the specified TLS service and then attempts to authenticate its TLS server certificate according to its corresponding DANE TLSA records in the DNS.
Port: 443
Domain name: johnscott.me
Checking Transcript:
Host: johnscott.me Port: 443
SNI: johnscott.me
DNS TLSA RRset:
qname: _443._tcp.johnscott.me.
3 1 1 4255623d4db4263d02248265355d76d2ce506f41d102b651b0b32ac4eebc9a0a
3 1 1 3c2ac10bea704d0cb6ef440690535e563ba144dfc263d77ef0ebd62f2b5f82da
IP Addresses found:
2600:3c03::f03c:93ff:fef6:24
172.104.214.157
## Checking johnscott.me 2600:3c03::f03c:93ff:fef6:24 port 443
DANE TLSA 3 1 1 [4255623d..]: not checked
DANE TLSA 3 1 1 [3c2ac10b..]: not checked
Result: FAILED: dial tcp [2600:3c03::f03c:93ff:fef6:24]:443: connect: no route to host
## Checking johnscott.me 172.104.214.157 port 443
DANE TLSA 3 1 1 [4255623d..]: FAIL did not match EE certificate
DANE TLSA 3 1 1 [3c2ac10b..]: OK matched EE certificate
## Peer Certificate Chain:
0 CN=johnscott.me
CN=R3,O=Let's Encrypt,C=US
1 CN=R3,O=Let's Encrypt,C=US
CN=ISRG Root X1,O=Internet Security Research Group,C=US
## PKIX Certificate Chain 0:
0 CN=johnscott.me
CN=R3,O=Let's Encrypt,C=US
1 CN=R3,O=Let's Encrypt,C=US
CN=ISRG Root X1,O=Internet Security Research Group,C=US
2 CN=ISRG Root X1,O=Internet Security Research Group,C=US
CN=ISRG Root X1,O=Internet Security Research Group,C=US
## DANE Certificate Chain 0:
0 CN=johnscott.me
CN=R3,O=Let's Encrypt,C=US
1 CN=R3,O=Let's Encrypt,C=US
CN=ISRG Root X1,O=Internet Security Research Group,C=US
## TLS Connection Info:
TLS version: 1.3
CipherSuite: TLS_AES_128_GCM_SHA256
## End-Entity Certificate Info:
X509 version: 3
Serial#: 4040fa02319b7b1b0701b8137bde4b013d0
Subject: CN=johnscott.me
Issuer: CN=R3,O=Let's Encrypt,C=US
SAN dNSName: johnscott.me
Signature Algorithm: SHA256-RSA
PublicKey Algorithm: ECDSA 511-Bits
Inception: 2024-03-14 10:48:22 +0000 UTC
Expiration: 2024-06-12 10:48:21 +0000 UTC
KU: DigitalSignature
EKU: ServerAuth ClientAuth
Is CA?: false
SKI: 0e82adbe9b47773df0d4f5205bb462903cce2091
AKI: 142eb317b75856cbae500940e61faf9d8b14c2c6
OSCP Servers: [http://r3.o.lencr.org]
CA Issuer URL: [http://r3.i.lencr.org/]
CRL Distribution: []
Policy OIDs: [2.23.140.1.2.1]
Result: DANE OK
[1] Authentication succeeded for some (1 of 2) peers.