search

aeris / cryptcheck

Verify some SSL/TLS website or XMPP implementation
GNU Affero General Public License v3.0
185 stars 20 forks source link

Lower score on subdomain #61

Closed mkody closed 1 year ago

mkody commented 1 year ago

Hi,

With cryptcheck.fr I got an E rank on search.im-in.space and while I would take that as I need to fix my settings I can't really understand what and how when the same server and TLS config gives me an A+ for im-in.space. Trying again but on tls.imirhil.fr I get an A.

Is there something not working properly with it being a subdomain? Or am I missing something? Thanks.

aeris commented 1 year ago

Hello!

Seems you haven't HSTS enable on this website, and so the E rank.

It's visible on the JSON raw result https://cryptcheck.fr/https/search.im-in.space.json

mkody commented 1 year ago

Oh, thanks for the JSON raw results, that's useful!

I now found the cause - server may be returning a non-200 code so nginx wasn't adding the header without always. Thanks!