D:\WORK\NARA\herramientas\qa\.venv\Lib\site-packages\sslyze\plugins\certificate_info\trust_stores\trust_store.py:55: CryptographyDeprecationWarning: Parsed a serial number which wasn't positive (i.e., it was negative or zero), which is disallowed by RFC 5280. Loading this certificate will cause an exception in a future release of cryptography. self._x509_store = Store(load_pem_x509_certificates(self.path.read_bytes())) CHECKING CONNECTIVITY TO SERVER(S) ---------------------------------- nara-api-wyvw.onrender.com:443 => 216.24.57.18 www.proyectonara.com:443 => 64.29.17.1 proyectonara.com:443 => 64.29.17.1 SCAN RESULTS FOR NARA-API-WYVW.ONRENDER.COM:443 - 216.24.57.18 -------------------------------------------------------------- * Certificates Information: Hostname sent for SNI: nara-api-wyvw.onrender.com Number of cert chains detected: 2 (ECPublicKey, RSAPublicKey) Cert chain with SNI disabled: No Certificate Chain #1 (ECPublicKey, SNI enabled) SHA1 Fingerprint: 5b1c6b87238fa11c7afbccc035d845d38288b85a Common Name: onrender.com Issuer: WE1 Serial Number: 147138740349927833558463040617883746615 Not Before: 2026-09-21 Not After: 2026-12-20 Public Key Algorithm: ECPublicKey Signature Algorithm: sha256 Key Size: 256 Curve: secp256r1 SubjAltName - DNS Names: ['onrender.com', '*.onrender.com'] Trust Android CA Store (16.0.0_r4): OK - Certificate is trusted Apple CA Store (iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26):OK - Certificate is trusted Java CA Store (jdk-13.0.2): OK - Certificate is trusted Mozilla CA Store (2026-03-28): OK - Certificate is trusted Windows CA Store (2026-03-28): OK - Certificate is trusted Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate Received Chain: onrender.com --> WE1 --> GTS Root R4 Verified Chain: onrender.com --> WE1 --> GTS Root R4 Received Chain Contains Anchor: OK - Anchor certificate not sent Received Chain Order: OK - Order is valid Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain Certificate Extensions OCSP Must-Staple: NOT SUPPORTED - Extension not found Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more OCSP Stapling NOT SUPPORTED - Server did not send back an OCSP response Certificate Chain #2 (RSAPublicKey, SNI enabled) SHA1 Fingerprint: 25ef113cd2cc5ab8c8956988d4bb0460668a7b14 Common Name: onrender.com Issuer: WR1 Serial Number: 263014105353461925444206421272661748491 Not Before: 2026-09-21 Not After: 2026-12-20 Public Key Algorithm: RSAPublicKey Signature Algorithm: sha256 Key Size: 2048 Exponent: 65537 SubjAltName - DNS Names: ['onrender.com', '*.onrender.com'] Trust Android CA Store (16.0.0_r4): OK - Certificate is trusted Apple CA Store (iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26):OK - Certificate is trusted Java CA Store (jdk-13.0.2): OK - Certificate is trusted Mozilla CA Store (2026-03-28): OK - Certificate is trusted Windows CA Store (2026-03-28): OK - Certificate is trusted Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate Received Chain: onrender.com --> WR1 --> GTS Root R1 Verified Chain: onrender.com --> WR1 --> GTS Root R1 Received Chain Contains Anchor: OK - Anchor certificate not sent Received Chain Order: OK - Order is valid Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain Certificate Extensions OCSP Must-Staple: NOT SUPPORTED - Extension not found Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more OCSP Stapling NOT SUPPORTED - Server did not send back an OCSP response * SSL 2.0 Cipher Suites: Attempted to connect using 7 cipher suites; the server rejected all cipher suites. * SSL 3.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 6 cipher suites: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: secp256r1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: secp256r1 (256 bits) TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 256 ECDH: secp256r1 (256 bits) TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 128 ECDH: secp256r1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) TLS_AES_128_GCM_SHA256 128 ECDH: X25519 (253 bits) * Deflate Compression: OK - Compression disabled * OpenSSL CCS Injection: OK - Not vulnerable to OpenSSL CCS injection * Downgrade Attacks: TLS_FALLBACK_SCSV: OK - Supported * OpenSSL Heartbleed: OK - Not vulnerable to Heartbleed * ROBOT Attack: OK - Not vulnerable, RSA cipher suites not supported. * Session Renegotiation: Client Renegotiation DoS Attack: OK - Not vulnerable Secure Renegotiation: OK - Supported * Elliptic Curve Key Exchange: Supported curves: X25519, secp256r1, secp384r1, secp521r1 Rejected curves: X448, brainpoolP256r1, brainpoolP384r1, brainpoolP512r1, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1 * TLS Extended Master Secret Extension: OK - Supported SCAN RESULTS FOR WWW.PROYECTONARA.COM:443 - 64.29.17.1 ------------------------------------------------------ * Certificates Information: Hostname sent for SNI: www.proyectonara.com Number of cert chains detected: 1 (RSAPublicKey) Cert chain with SNI disabled: Yes Certificate Chain #1 (RSAPublicKey, SNI enabled) SHA1 Fingerprint: 7a2f28cd89a8fb935544d67904aa685463f20ac3 Common Name: www.proyectonara.com Issuer: YR2 Serial Number: 570175729744550629114013336003902594262137 Not Before: 2026-10-06 Not After: 2027-01-04 Public Key Algorithm: RSAPublicKey Signature Algorithm: sha256 Key Size: 2048 Exponent: 65537 SubjAltName - DNS Names: ['www.proyectonara.com'] Trust Android CA Store (16.0.0_r4): OK - Certificate is trusted Apple CA Store (iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26):OK - Certificate is trusted Java CA Store (jdk-13.0.2): OK - Certificate is trusted Mozilla CA Store (2026-03-28): OK - Certificate is trusted Windows CA Store (2026-03-28): OK - Certificate is trusted Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate Received Chain: www.proyectonara.com --> YR2 --> Root YR Verified Chain: www.proyectonara.com --> YR2 --> Root YR --> ISRG Root X1 Received Chain Contains Anchor: OK - Anchor certificate not sent Received Chain Order: OK - Order is valid Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain Certificate Extensions OCSP Must-Staple: NOT SUPPORTED - Extension not found Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more OCSP Stapling NOT SUPPORTED - Server did not send back an OCSP response Certificate Chain with SNI disabled - can be ignored SHA1 Fingerprint: a3af13dfefce5f1f874f8f92785f29f007f3d05e Common Name: no-sni.vercel-infra.com Issuer: YR1 Serial Number: 515581264538794514171339829899737834198397 Not Before: 2026-09-21 Not After: 2026-12-20 Public Key Algorithm: RSAPublicKey Signature Algorithm: sha256 Key Size: 2048 Exponent: 65537 SubjAltName - DNS Names: ['no-sni.vercel-infra.com'] Trust Android CA Store (16.0.0_r4): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Apple CA Store (iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26):FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Java CA Store (jdk-13.0.2): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Mozilla CA Store (2026-03-28): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Windows CA Store (2026-03-28): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Symantec 2018 Deprecation: ERROR - Could not build verified chain (certificate untrusted?) Received Chain: no-sni.vercel-infra.com --> YR1 --> Root YR Verified Chain: ERROR - Could not build verified chain (certificate untrusted?) Received Chain Contains Anchor: ERROR - Could not build verified chain (certificate untrusted?) Received Chain Order: OK - Order is valid Verified Chain contains SHA1: ERROR - Could not build verified chain (certificate untrusted?) Certificate Extensions OCSP Must-Staple: NOT SUPPORTED - Extension not found Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more OCSP Stapling NOT SUPPORTED - Server did not send back an OCSP response * SSL 2.0 Cipher Suites: Attempted to connect using 7 cipher suites; the server rejected all cipher suites. * SSL 3.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 3 cipher suites: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: secp256r1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: secp256r1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) TLS_AES_128_GCM_SHA256 128 ECDH: X25519 (253 bits) * Deflate Compression: OK - Compression disabled * OpenSSL CCS Injection: OK - Not vulnerable to OpenSSL CCS injection * Downgrade Attacks: TLS_FALLBACK_SCSV: OK - Supported * OpenSSL Heartbleed: OK - Not vulnerable to Heartbleed * ROBOT Attack: OK - Not vulnerable, RSA cipher suites not supported. * Session Renegotiation: Client Renegotiation DoS Attack: OK - Not vulnerable Secure Renegotiation: OK - Supported * Elliptic Curve Key Exchange: Supported curves: X25519, secp256r1, secp384r1, secp521r1 Rejected curves: X448, brainpoolP256r1, brainpoolP384r1, brainpoolP512r1, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1 * TLS Extended Master Secret Extension: OK - Supported SCAN RESULTS FOR PROYECTONARA.COM:443 - 64.29.17.1 -------------------------------------------------- * Certificates Information: Hostname sent for SNI: proyectonara.com Number of cert chains detected: 1 (RSAPublicKey) Cert chain with SNI disabled: Yes Certificate Chain #1 (RSAPublicKey, SNI enabled) SHA1 Fingerprint: 350bc95b795a684e3360ca0a0e1883fef322c30e Common Name: proyectonara.com Issuer: YR2 Serial Number: 566851889655042192504913774061401133076033 Not Before: 2026-10-06 Not After: 2027-01-04 Public Key Algorithm: RSAPublicKey Signature Algorithm: sha256 Key Size: 2048 Exponent: 65537 SubjAltName - DNS Names: ['proyectonara.com'] Trust Android CA Store (16.0.0_r4): OK - Certificate is trusted Apple CA Store (iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26):OK - Certificate is trusted Java CA Store (jdk-13.0.2): OK - Certificate is trusted Mozilla CA Store (2026-03-28): OK - Certificate is trusted Windows CA Store (2026-03-28): OK - Certificate is trusted Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate Received Chain: proyectonara.com --> YR2 --> Root YR Verified Chain: proyectonara.com --> YR2 --> Root YR --> ISRG Root X1 Received Chain Contains Anchor: OK - Anchor certificate not sent Received Chain Order: OK - Order is valid Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain Certificate Extensions OCSP Must-Staple: NOT SUPPORTED - Extension not found Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more OCSP Stapling NOT SUPPORTED - Server did not send back an OCSP response Certificate Chain with SNI disabled - can be ignored SHA1 Fingerprint: a3af13dfefce5f1f874f8f92785f29f007f3d05e Common Name: no-sni.vercel-infra.com Issuer: YR1 Serial Number: 515581264538794514171339829899737834198397 Not Before: 2026-09-21 Not After: 2026-12-20 Public Key Algorithm: RSAPublicKey Signature Algorithm: sha256 Key Size: 2048 Exponent: 65537 SubjAltName - DNS Names: ['no-sni.vercel-infra.com'] Trust Android CA Store (16.0.0_r4): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Apple CA Store (iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26):FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Java CA Store (jdk-13.0.2): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Mozilla CA Store (2026-03-28): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Windows CA Store (2026-03-28): FAILED - Certificate is NOT Trusted: validation failed: leaf certificate has no matching subjectAltName (encountered processing , ...)>) Symantec 2018 Deprecation: ERROR - Could not build verified chain (certificate untrusted?) Received Chain: no-sni.vercel-infra.com --> YR1 --> Root YR Verified Chain: ERROR - Could not build verified chain (certificate untrusted?) Received Chain Contains Anchor: ERROR - Could not build verified chain (certificate untrusted?) Received Chain Order: OK - Order is valid Verified Chain contains SHA1: ERROR - Could not build verified chain (certificate untrusted?) Certificate Extensions OCSP Must-Staple: NOT SUPPORTED - Extension not found Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more OCSP Stapling NOT SUPPORTED - Server did not send back an OCSP response * SSL 2.0 Cipher Suites: Attempted to connect using 7 cipher suites; the server rejected all cipher suites. * SSL 3.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 3 cipher suites: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: secp256r1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: secp256r1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) TLS_AES_128_GCM_SHA256 128 ECDH: X25519 (253 bits) * Deflate Compression: OK - Compression disabled * OpenSSL CCS Injection: OK - Not vulnerable to OpenSSL CCS injection * Downgrade Attacks: TLS_FALLBACK_SCSV: OK - Supported * OpenSSL Heartbleed: OK - Not vulnerable to Heartbleed * ROBOT Attack: OK - Not vulnerable, RSA cipher suites not supported. * Session Renegotiation: Client Renegotiation DoS Attack: OK - Not vulnerable Secure Renegotiation: OK - Supported * Elliptic Curve Key Exchange: Supported curves: X25519, secp256r1, secp384r1, secp521r1 Rejected curves: X448, brainpoolP256r1, brainpoolP384r1, brainpoolP512r1, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1 * TLS Extended Master Secret Extension: OK - Supported SCANS COMPLETED IN 28.146528 S ------------------------------ Wrote JSON output to "D:\WORK\NARA\pruebas\evidencia\2026-10-10-5\6.10\sslyze.json". COMPLIANCE AGAINST TLS CONFIGURATION ------------------------------------ Checking results against Mozilla's "intermediate" configuration. See https://ssl-config.mozilla.org/ for more details. nara-api-wyvw.onrender.com:443: FAILED - Not compliant. * tls_curves: TLS curves {'secp521r1'} are supported, but should be rejected. www.proyectonara.com:443: FAILED - Not compliant. * tls_curves: TLS curves {'secp521r1'} are supported, but should be rejected. proyectonara.com:443: FAILED - Not compliant. * tls_curves: TLS curves {'secp521r1'} are supported, but should be rejected.