TLS scan results for February 2016 (incomplete)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Unfortunately during scanning the disk space on the server run out so the 
results are not complete.

Other than that, no interesting developments, just continuation of established 
trends.

SSL/TLS survey of 479178 websites from Alexa's top 1 million
Stats only from connections that did provide valid certificates
(or anonymous DH from servers that do also have valid certificate installed)


Supported Ciphers         Count     Percent
-------------------------+---------+-------
3DES                      419340    87.5124
3DES Only                 506       0.1056
3DES Preferred            1692      0.3531
3DES forced in TLS1.1+    922       0.1924
AES                       474652    99.0555
AES Only                  37306     7.7854
AES-CBC                   474138    98.9482
AES-CBC Only              7523      1.57
AES-GCM                   380917    79.4938
AES-GCM Only              466       0.0972
CAMELLIA                  201933    42.1415
CAMELLIA Only             3         0.0006
CHACHA20                  66326     13.8416
CHACHA20 Only             1         0.0002
Insecure                  48383     10.0971
RC4                       149250    31.1471
RC4 Only                  177       0.0369
RC4 Preferred             15506     3.236
RC4 forced in TLS1.1+     8442      1.7618
x:FF 29 3DES Only         550       0.1148
x:FF 29 3DES Preferred    2012      0.4199
x:FF 29 RC4 Only          265       0.0553
x:FF 29 RC4 Preferred     17097     3.568
x:FF 29 incompatible      321       0.067
x:FF 35 3DES Only         559       0.1167
x:FF 35 3DES Preferred    1924      0.4015
x:FF 35 RC4 Only          311       0.0649
x:FF 35 RC4 Preferred     17124     3.5736
x:FF 35 incompatible      325       0.0678
y:DHE-RSA-SEED-SHA        60590     12.6446
y:IDEA-CBC-SHA            58075     12.1197
y:SEED-SHA                70022     14.6129
z:ADH-AES128-GCM-SHA256   354       0.0739
z:ADH-AES128-SHA          605       0.1263
z:ADH-AES128-SHA256       246       0.0513
z:ADH-AES256-GCM-SHA384   367       0.0766
z:ADH-AES256-SHA          618       0.129
z:ADH-AES256-SHA256       245       0.0511
z:ADH-CAMELLIA128-SHA     316       0.0659
z:ADH-CAMELLIA256-SHA     321       0.067
z:ADH-DES-CBC-SHA         243       0.0507
z:ADH-DES-CBC3-SHA        620       0.1294
z:ADH-RC4-MD5             455       0.095
z:ADH-SEED-SHA            254       0.053
z:AECDH-AES128-SHA        7521      1.5696
z:AECDH-AES256-SHA        7556      1.5769
z:AECDH-DES-CBC3-SHA      7499      1.565
z:AECDH-NULL-SHA          45        0.0094
z:AECDH-RC4-SHA           7010      1.4629
z:DES-CBC-MD5             7605      1.5871
z:DES-CBC-SHA             30728     6.4126
z:DES-CBC3-MD5            17199     3.5893
z:ECDHE-RSA-NULL-SHA      53        0.0111
z:EDH-RSA-DES-CBC-SHA     25945     5.4145
z:EXP-ADH-DES-CBC-SHA     148       0.0309
z:EXP-ADH-RC4-MD5         145       0.0303
z:EXP-DES-CBC-SHA         10647     2.2219
z:EXP-EDH-RSA-DES-CBC-SHA 8346      1.7417
z:EXP-RC2-CBC-MD5         12795     2.6702
z:EXP-RC4-MD5             13391     2.7946
z:EXP1024-DES-CBC-SHA     3415      0.7127
z:EXP1024-RC4-SHA         3465      0.7231
z:IDEA-CBC-MD5            1613      0.3366
z:NULL-MD5                162       0.0338
z:NULL-SHA                169       0.0353
z:NULL-SHA256             38        0.0079
z:RC2-CBC-MD5             7754      1.6182
z:RC4-64-MD5              712       0.1486

Cipher ordering           Count     Percent
-------------------------+---------+-------
Client side               116701    24.3544
Server side               362477    75.6456

Supported Handshakes      Count     Percent
-------------------------+---------+-------
ADH                       753       0.1571
AECDH                     7568      1.5794
DHE                       255330    53.285
ECDH                      2         0.0004
ECDHE                     404645    84.4457
ECDHE and DHE             212045    44.2518
RSA                       411697    85.9173

Supported PFS             Count     Percent  PFS Percent
-------------------------+---------+--------+-----------
DH,1024bits               107150    22.3612  41.9653
DH,1338bits               1         0.0002   0.0004
DH,1536bits               1         0.0002   0.0004
DH,2048bits               139444    29.1007  54.6132
DH,2236bits               57        0.0119   0.0223
DH,2432bits               3         0.0006   0.0012
DH,3072bits               93        0.0194   0.0364
DH,3092bits               1         0.0002   0.0004
DH,4096bits               8367      1.7461   3.2769
DH,512bits                52        0.0109   0.0204
DH,768bits                313       0.0653   0.1226
DH,8192bits               7         0.0015   0.0027
ECDH,B-571,570bits        1786      0.3727   0.4414
ECDH,K-163,163bits        1         0.0002   0.0002
ECDH,P-192,192bits        15        0.0031   0.0037
ECDH,P-224,224bits        84        0.0175   0.0208
ECDH,P-256,256bits        389954    81.3798  96.3694
ECDH,P-384,384bits        4297      0.8967   1.0619
ECDH,P-521,521bits        10105     2.1088   2.4973
Prefer DH,1024bits        41750     8.7128   16.3514
Prefer DH,1536bits        1         0.0002   0.0004
Prefer DH,2048bits        4670      0.9746   1.829
Prefer DH,3072bits        7         0.0015   0.0027
Prefer DH,4096bits        333       0.0695   0.1304
Prefer DH,768bits         37        0.0077   0.0145
Prefer ECDH,B-571,570bits 1575      0.3287   0.3892
Prefer ECDH,K-163,163bits 1         0.0002   0.0002
Prefer ECDH,P-224,224bits 81        0.0169   0.02
Prefer ECDH,P-256,256bits 357787    74.6668  88.42
Prefer ECDH,P-384,384bits 3158      0.659    0.7804
Prefer ECDH,P-521,521bits 9166      1.9129   2.2652
Prefer PFS                418566    87.3508  0
Support PFS               447930    93.4788  0

Supported ECC curves      Count     Percent 
-------------------------+---------+--------
brainpoolP256r1           5523      1.1526   
brainpoolP384r1           5524      1.1528   
brainpoolP512r1           5525      1.153    
prime192v1                1353      0.2824   
prime256v1                401476    83.7843  
prime256v1 Only           345957    72.198   
secp160k1                 1299      0.2711   
secp160r1                 1304      0.2721   
secp160r2                 1299      0.2711   
secp192k1                 1314      0.2742   
secp224k1                 1392      0.2905   
secp224r1                 4371      0.9122   
secp256k1                 7238      1.5105   
secp384r1                 56063     11.6998  
secp384r1 Only            584       0.1219   
secp521r1                 28028     5.8492   
secp521r1 Only            125       0.0261   
sect163k1                 1310      0.2734   
sect163k1 Only            3         0.0006   
sect163r1                 1306      0.2726   
sect163r2                 1307      0.2728   
sect193r1                 1306      0.2726   
sect193r2                 1304      0.2721   
sect233k1                 1387      0.2895   
sect233r1                 1386      0.2892   
sect239k1                 1383      0.2886   
sect283k1                 6795      1.4181   
sect283k1 Only            1         0.0002   
sect283r1                 6792      1.4174   
sect409k1                 6793      1.4176   
sect409r1                 6793      1.4176   
sect571k1                 6797      1.4185   
sect571r1                 6797      1.4185   

Unsupported curve fallback     Count     Percent 
------------------------------+---------+--------
False                          43974     9.177    
True                           304974    63.6452  
order-specific                 61        0.0127   
unknown                        130169    27.1651  

ECC curve ordering        Count     Percent 
-------------------------+---------+--------
client                    6487      1.3538   
inconclusive-noecc        8         0.0017   
server                    395730    82.5852  
unknown                   76953     16.0594  

TLSv1.2 PFS supported sigalgs  Count     Percent 
------------------------------+---------+--------
ECDSA-SHA1                     40044     8.3568   
ECDSA-SHA1 Only                3         0.0006   
ECDSA-SHA224                   40035     8.3549   
ECDSA-SHA256                   54403     11.3534  
ECDSA-SHA384                   54398     11.3524  
ECDSA-SHA512                   54399     11.3526  
ECDSA-SHA512 Only              1         0.0002   
RSA-MD5                        47971     10.0111  
RSA-SHA1                       347530    72.5263  
RSA-SHA1 Only                  36263     7.5678   
RSA-SHA224                     288147    60.1336  
RSA-SHA256                     318675    66.5045  
RSA-SHA256 Only                6467      1.3496   
RSA-SHA384                     290085    60.538   
RSA-SHA384 Only                2         0.0004   
RSA-SHA512                     290093    60.5397  
RSA-SHA512 Only                126       0.0263   

TLSv1.2 PFS ordering           Count     Percent 
------------------------------+---------+--------
client                         215610    44.9958  
indeterminate                  32        0.0067   
intolerant                     4623      0.9648   
order-fallback                 3         0.0006   
server                         175045    36.5303  
unsupported                    17219     3.5934   

TLSv1.2 PFS sigalg fallback    Count     Percent 
------------------------------+---------+--------
ECDSA SHA1                     40031     8.3541   
ECDSA intolerant               47        0.0098   
ECDSA pfs-rsa-SHA512           14337     2.992    
ECDSA soft-nopfs               1         0.0002   
RSA False                      47573     9.928    
RSA SHA1                       274148    57.2121  
RSA intolerant                 34088     7.1138   
RSA pfs-ecdsa-SHA512           4         0.0008   
RSA soft-nopfs                 498       0.1039   

Renegotiation             Count     Percent 
-------------------------+---------+--------
False                     5212      1.0877   
insecure                  15480     3.2305   
secure                    458486    95.6818  

Compression               Count     Percent 
-------------------------+---------+--------
1 (zlib compression)      7370      1.5381   
False                     5212      1.0877   
NONE                      466596    97.3743  

TLS session ticket hint   Count     Percent 
-------------------------+---------+--------
1                         4         0.0008   
1 only                    4         0.0008   
2                         1         0.0002   
2 only                    1         0.0002   
10                        6         0.0013   
10 only                   6         0.0013   
15                        5         0.001    
15 only                   5         0.001    
30                        18        0.0038   
30 only                   17        0.0035   
60                        142       0.0296   
60 only                   138       0.0288   
65                        1         0.0002   
65 only                   1         0.0002   
70                        6         0.0013   
100                       15        0.0031   
100 only                  15        0.0031   
120                       24        0.005    
120 only                  24        0.005    
128                       3         0.0006   
128 only                  3         0.0006   
150                       1         0.0002   
180                       58        0.0121   
180 only                  55        0.0115   
240                       7         0.0015   
240 only                  7         0.0015   
244                       1         0.0002   
244 only                  1         0.0002   
300                       230415    48.0855  
300 only                  226909    47.3538  
302                       2         0.0004   
302 only                  2         0.0004   
360                       3         0.0006   
360 only                  1         0.0002   
400                       7         0.0015   
400 only                  7         0.0015   
420                       116       0.0242   
420 only                  93        0.0194   
480                       10        0.0021   
480 only                  10        0.0021   
500                       4         0.0008   
500 only                  4         0.0008   
540                       2         0.0004   
540 only                  2         0.0004   
600                       23920     4.9919   
600 only                  23758     4.9581   
660                       1         0.0002   
660 only                  1         0.0002   
840                       1         0.0002   
840 only                  1         0.0002   
900                       983       0.2051   
900 only                  962       0.2008   
960                       3         0.0006   
960 only                  3         0.0006   
1000                      1         0.0002   
1000 only                 1         0.0002   
1200                      2630      0.5489   
1200 only                 2627      0.5482   
1320                      1         0.0002   
1320 only                 1         0.0002   
1500                      2         0.0004   
1500 only                 1         0.0002   
1800                      500       0.1043   
1800 only                 491       0.1025   
1980                      2         0.0004   
1980 only                 2         0.0004   
2100                      2         0.0004   
2100 only                 1         0.0002   
2400                      7         0.0015   
2400 only                 7         0.0015   
2700                      10        0.0021   
2700 only                 10        0.0021   
3000                      26        0.0054   
3000 only                 26        0.0054   
3600                      664       0.1386   
3600 only                 655       0.1367   
3900                      1         0.0002   
3900 only                 1         0.0002   
5160                      1         0.0002   
5160 only                 1         0.0002   
5400                      15        0.0031   
5400 only                 8         0.0017   
6000                      214       0.0447   
6000 only                 214       0.0447   
7200                      14927     3.1151   
7200 only                 14908     3.1112   
10800                     3286      0.6858   
10800 only                3277      0.6839   
14400                     93        0.0194   
14400 only                91        0.019    
18000                     9         0.0019   
18000 only                9         0.0019   
21600                     3668      0.7655   
21600 only                3668      0.7655   
25200                     1         0.0002   
25200 only                1         0.0002   
28800                     1854      0.3869   
28800 only                1853      0.3867   
36000                     954       0.1991   
36000 only                945       0.1972   
43200                     39        0.0081   
43200 only                39        0.0081   
60000                     1         0.0002   
60000 only                1         0.0002   
64800                     56248     11.7384  
64800 only                56243     11.7374  
72000                     21        0.0044   
72000 only                21        0.0044   
79200                     1         0.0002   
79200 only                1         0.0002   
86000                     44        0.0092   
86000 only                44        0.0092   
86400                     2743      0.5724   
86400 only                2734      0.5706   
100800                    8629      1.8008   
100800 only               8618      1.7985   
115200                    1         0.0002   
115200 only               1         0.0002   
129600                    7         0.0015   
129600 only               7         0.0015   
172800                    9         0.0019   
172800 only               9         0.0019   
216000                    2         0.0004   
216000 only               2         0.0004   
259200                    2         0.0004   
259200 only               2         0.0004   
432000                    1         0.0002   
432000 only               1         0.0002   
604800                    2         0.0004   
864000                    3         0.0006   
864000 only               3         0.0006   
7776000                   2         0.0004   
7776000 only              2         0.0004   
None                      130619    27.259   
None only                 126799    26.4618  

Certificate sig alg     Count     Percent 
-------------------------+---------+--------
None                      8093      1.6889   
ecdsa-with-SHA256         54346     11.3415  
sha1WithRSAEncryption     32309     6.7426   
sha256WithRSAEncryption   406902    84.9167  
sha384WithRSAEncryption   3         0.0006   
sha512WithRSAEncryption   52        0.0109   

Certificate key size    Count     Percent 
-------------------------+---------+--------
ECDSA 256                 54398     11.3524  
ECDSA 384                 18        0.0038   
ECDSA 521                 1         0.0002   
RSA 1024                  28        0.0058   
RSA 2048                  416954    87.0144  
RSA 2049                  3         0.0006   
RSA 2056                  2         0.0004   
RSA 2058                  2         0.0004   
RSA 2084                  4         0.0008   
RSA 2086                  1         0.0002   
RSA 2096                  2         0.0004   
RSA 2432                  1         0.0002   
RSA 3071                  1         0.0002   
RSA 3072                  118       0.0246   
RSA 3073                  1         0.0002   
RSA 3076                  2         0.0004   
RSA 3096                  2         0.0004   
RSA 3248                  2         0.0004   
RSA 4048                  1         0.0002   
RSA 4056                  17        0.0035   
RSA 4092                  7         0.0015   
RSA 4094                  1         0.0002   
RSA 4096                  22025     4.5964   
RSA 4098                  1         0.0002   
RSA 8192                  4         0.0008   
RSA 8392                  1         0.0002   
RSA/ECDSA Dual Stack      14407     3.0066

OCSP stapling             Count     Percent 
-------------------------+---------+--------
Supported                 112039    23.3815  
Unsupported               367139    76.6185  

Supported Protocols       Count     Percent
-------------------------+---------+-------
SSL2                      17376     3.6262
SSL2 Only                 10        0.0021
SSL3                      93563     19.5257
SSL3 Only                 980       0.2045
SSL3 or TLS1 Only         47829     9.9815
SSL3 or lower Only        992       0.207
TLS1                      472039    98.5102
TLS1 Only                 29199     6.0936
TLS1 or lower Only        63377     13.2262
TLS1.1                    404578    84.4317
TLS1.1 Only               297       0.062
TLS1.1 or up Only         5984      1.2488
TLS1.2                    412518    86.0887
TLS1.2 Only               2158      0.4504
TLS1.2, 1.0 but not 1.1   7981      1.6656



Statistics from 487333 chains provided by 621854 hosts

Server provided chains    Count     Percent
-------------------------+---------+-------
complete                  436283    70.1584
incomplete                20784     3.3423
untrusted                 164787    26.4993

Trusted chain statistics
========================

Chain length              Count     Percent
-------------------------+---------+-------
2                         12        0.0025
3                         485364    99.596
4                         1945      0.3991
5                         12        0.0025

CA key size in chains     Count
-------------------------+---------
ECDSA 256                 42987     
ECDSA 384                 42988     
RSA 1024                  28        
RSA 2045                  2         
RSA 2048                  746942    
RSA 4096                  143676    

Chains with CA key        Count     Percent
-------------------------+---------+-------
ECDSA 256                 42987     8.8209
ECDSA 384                 42988     8.8211
RSA 1024                  26        0.0053
RSA 2045                  2         0.0004
RSA 2048                  443976    91.1032
RSA 4096                  143127    29.3694

Signature algorithm (ex. root) Count
------------------------------+---------
ecdsa-with-SHA384              42983     
sha1WithRSAEncryption          37695     
sha256WithRSAEncryption        279113    
sha384WithRSAEncryption        129437    
sha512WithRSAEncryption        62        

Eff. host cert chain LoS  Count     Percent
-------------------------+---------+-------
80                        37722     7.7405
112                       406613    83.4364
128.0                     42998     8.8231

Root CAs                                      Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 115692    23.7398
(2c543cd1) GeoTrust Global CA                 85975     17.6419
(cbf06781) Go Daddy Root Certificate Authorit 43560     8.9384
(eed8c118) COMODO ECC Certification Authority 42977     8.8188
(5ad8a5d6) GlobalSign Root CA                 41299     8.4745
(b204d74a) VeriSign Class 3 Public Primary Ce 28043     5.7544
(244b5494) DigiCert High Assurance EV Root CA 18414     3.7785
(2e4eed3c) thawte Primary Root CA             17524     3.5959
(fc5a8f99) USERTrust RSA Certification Author 13626     2.796
(653b494a) Baltimore CyberTrust Root          10432     2.1406
(3513523f) DigiCert Global Root CA            8525      1.7493
(ae8153b9) StartCom Certification Authority   7668      1.5735
(4bfab552) Starfield Root Certificate Authori 7663      1.5724
(480720ec) GeoTrust Primary Certification Aut 4978      1.0215

Scan performed between 22nd of February and 16th of March 2016
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

Attachment: signature.asc
Description: This is a digitally signed message part.

--
security mailing list
security@xxxxxxxxxxxxxxxxxxxxxxx
https://lists.fedoraproject.org/admin/lists/security@xxxxxxxxxxxxxxxxxxxxxxx

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Coolkey]

  Powered by Linux