aethercert

connect-app.net

Scanned 1 hour ago · Sep 24, 2026, 8:50 AM

B

TLS & Certificate

Protocol support, cipher strength and the certificate chain, evaluated the way a browser would.

Score79%
  • the server still accepts TLS 1.0 and/or TLS 1.1, both deprecated
  • the server does not support TLS 1.3
  • the server accepts 4 weak cipher suite(s): ECDHE-RSA-AES256-SHA384, ECDHE-RSA-AES128-SHA256, AES256-GCM-SHA384, AES128-GCM-SHA256
NegotiatedTLSv1.2, ECDHE-RSA-AES128-GCM-SHA256
Forward secrecyYes
HSTSenabled, max-age=15768000

Protocol baseline

NoTLS 1.3 enabled
YesTLS 1.2 enabled
NoTLS 1.1 disabled
NoTLS 1.0 disabled

Cipher suites probed

Each suite below was tested with its own TLS 1.2 handshake, restricted to exactly that cipher - "accepted" means the server completed a handshake using it, not merely that it's listed as a possibility.

ECDHE-ECDSA-AES256-GCM-SHA384
SecureNot offered
ECDHE-RSA-AES256-GCM-SHA384
SecureAccepted
ECDHE-ECDSA-AES128-GCM-SHA256
SecureNot offered
ECDHE-RSA-AES128-GCM-SHA256
SecureAccepted
ECDHE-ECDSA-CHACHA20-POLY1305
SecureNot offered
ECDHE-RSA-CHACHA20-POLY1305
SecureNot offered
DHE-RSA-AES256-GCM-SHA384
SecureAccepted
DHE-RSA-AES128-GCM-SHA256
SecureAccepted
ECDHE-RSA-AES256-SHA384
WeakAccepted
ECDHE-RSA-AES128-SHA256
WeakAccepted
AES256-GCM-SHA384
WeakAccepted
AES128-GCM-SHA256
WeakAccepted
DES-CBC3-SHA
InsecureNot offered
RC4-SHA
InsecureNot offered
NULL-SHA
InsecureNot offered

Certificate

Subjectconnect-app.net
IssuerSectigo Public Server Authentication CA DV R36
Additional namesconnect-app.net, www.connect-app.net
ValidSep 14, 2026, 12:00 AM – Mar 31, 2027, 11:59 PM (expires in 189 days)
KeyRSA 2048 bit
Signature algorithmunknown
SHA-256 fingerprint01:17:59:9B:EE:36:5E:98:2E:5F:6F:15:67:E9:09:1C:06:56:79:CF:CD:C7:5D:EB:E5:DF:F2:79:A9:0C:5F:00
Certificate chain4 certificate(s)
Trusted by common trust storesYes
Matches the scanned hostnameYes
Self-signedNo
F

Security Headers

The HTTP response headers browsers use to restrict what a page - or an attacker inside it - can do.

Score25%
  • no Content-Security-Policy header
  • no X-Content-Type-Options: nosniff
  • no clickjacking protection (X-Frame-Options or frame-ancestors)
  • no Referrer-Policy header
  • no Permissions-Policy header
  • no Cross-Origin-Opener-Policy header
  • no Cross-Origin-Resource-Policy header
  • the Server header discloses "Apache/2.2.15 (CentOS)"
Content-Security-Policynot set
Strict-Transport-Securitymax-age=15768000
X-Content-Type-Optionsnot set
X-Frame-Optionsnot set
Referrer-Policynot set
Permissions-Policynot set
Cross-Origin-Opener-Policynot set
Cross-Origin-Resource-Policynot set
C

Email

Whether mail delivered to this domain is protected in transit, and whether SPF/DMARC stop it being spoofed.

Score69%
  • at least one reachable mail server does not support STARTTLS
  • no DMARC record
SPFv=spf1 ip4:202.181.103.15 ip6:2001:e42:102:1101:202:181:103:15 include:_spf.google.com ~all
DMARCnot set
MX recordsdb.connect-app.net

Mail servers

Each mail port is probed with a full TLS handshake - STARTTLS on 25, 587, 143 and 110, implicit TLS on 465, 993 and 995 - to read the certificate actually bound to it. Only inbound SMTP on port 25 affects the grade.

db.connect-app.netMX preference 1
25 SMTPreachable, STARTTLS not offered
587 Submissionno response - the port is filtered, or blocked between our scanner and the host
465 SMTPSno response - the port is filtered, or blocked between our scanner and the host
143 IMAPno response - the port is filtered, or blocked between our scanner and the host
993 IMAPSno response - the port is filtered, or blocked between our scanner and the host
110 POP3no response - the port is filtered, or blocked between our scanner and the host
995 POP3Sno response - the port is filtered, or blocked between our scanner and the host