What it is
Summarises the target's TLS configuration from a cached SSL Labs scan: the overall grade, supported protocol versions, forward secrecy, HSTS, and a checklist of historical vulnerabilities including Heartbleed, POODLE, ROBOT, FREAK, LOGJAM and DROWN.
Why it matters
The grade compresses a great deal of judgement into a single letter, and the checklist underneath it is where the detail lives. The scan is cached, so a configuration change made recently may not show up yet.
How this assessment works
Skopeon Labs queries public infrastructure signals and authoritative network protocols directly from external sensor nodes. All evaluations are completely non-invasive and agentless, assessing observable configurations without sending malicious payloads or disrupting service.
Operational Scope & Limitations
This check evaluates public perimeter responses observable at the time of inquiry. Endpoints protected behind third-party reverse proxies or CDNs reflect the edge configuration of the proxy layer.
Key terms
- Certificate Transparency
- Public logs of every certificate issued, so one issued by mistake or by an attacker gets noticed.
- SSL Labs Grade
- Qualys SSL Labs' overall rating of a server's HTTPS setup, from A+ down to F.
- Renegotiation
- Lets the browser and server agree new settings partway through a connection. Only the secure kind is safe.
- Fallback SCSV
- Stops attackers forcing a connection down to an older, weaker version of TLS.
- ChaCha20
- A cipher that runs faster than AES on phones and other devices without AES hardware.
- AEAD Ciphers
- Modern ciphers like AES-GCM and ChaCha20, which encrypt and check data in one step to avoid a whole class of attacks.
- CBC Ciphers
- An older cipher mode behind attacks like POODLE and Lucky 13.
- TLS Compression
- Compressing data before encrypting it, which the CRIME attack uses to steal cookies.
- Key Exchange Reuse
- Reusing the same temporary key exchange values across connections, which weakens forward secrecy.
- Weak DH Primes
- Widely shared Diffie-Hellman groups that are too small, so a well-funded attacker may already have broken them.
- Downgrade Attack
- Tricking a connection into using an older, weaker protocol or cipher, so it's easier to break.
- Padding Oracle
- A flaw where a server responds differently to badly padded data. By sending thousands of altered messages, attackers can use those replies to decrypt traffic.
- Heartbleed
- A bug in old OpenSSL versions that let anyone read server memory, including private keys and passwords.
- POODLE
- An attack on SSL 3.0 that decrypts data a byte at a time. Disabling SSL 3.0 fixes it.
- POODLE (TLS)
- A version of POODLE that works against TLS servers which don't check padding properly.
- Zombie POODLE
- A padding oracle in some servers that brings POODLE-style attacks back to CBC ciphers.
- GOLDENDOODLE
- A faster padding oracle attack on CBC ciphers, found in some firewalls and load balancers.
- Sleeping POODLE
- Another padding oracle on CBC ciphers, found in some network devices.
- FREAK
- Tricks a connection into using deliberately weak 1990s export encryption, which can be cracked in hours.
- Logjam
- Downgrades the key exchange to weak Diffie-Hellman groups that can be broken.
- DROWN
- Uses any server that still supports SSL 2.0 with the same key to decrypt modern TLS traffic.
- CCS Injection
- An OpenSSL bug (CVE-2014-0224) that lets an attacker force weak keys and read traffic.
- ROBOT
- A revived attack on RSA key exchange that can decrypt traffic, or sign messages with the server's key.
- Ticketbleed
- A bug in some F5 load balancers that leaks memory through TLS session tickets.