Deep SSL/TLS Vulnerability Test
This report provides a deep analysis of the SSL/TLS configuration of www.chess.com. It checks for protocol support, cipher strength, and known vulnerabilities.
Scan Results
Testing all IP addresses (port 443): 104.18.139.67 104.18.140.67 104.18.137.67 104.18.138.67 104.18.141.67 ----------------------------------------------------- Start 2026-09-27 11:25:15 -->> 104.18.139.67:443 (www.chess.com) <<-- Further IP addresses: 104.18.141.67 104.18.140.67 104.18.137.67 104.18.138.67 2606:4700::6812:8943 2606:4700::6812:8b43 2606:4700::6812:8d43 2606:4700::6812:8a43 2606:4700::6812:8c43 rDNS (104.18.139.67): -- Service detected: HTTP Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew 0 sec from localtime IPv4 address in header Set-Cookie: visitorid=%3A3628%3Affff%3A34.34.233.2; expires=Mon, 27 Sep 2027 11:25:38 GMT; Max-Age=31536000; path=/; httponly; samesite=lax (check if it's your IP address or e.g. a cluster IP) set-cookie: __cf_bm=px2xF6K.6dn3Y7GRdZ2ZesUMaB3_LHgUJSfWzw7GZmU-1790508338.4524508-1.0.1.1-56gzMi16bqKLmNAYduG1Uf5f4hcAjLG_YmPkEDb9Y3q0Mp_oOAztPg1ofY5F1ch4Cvv5r.MU_zlfRYur6NgyfphjIWROSF_Ngf12B8myQtJ6S9GLPeD9K3hXgls0uv966jG9Go05cmDa_hT5KhEmqw; HttpOnly; SameSite=None; Secure; Path=/; Domain=chess.com; Expires=Sun, 27 Sep 2026 11:55:38 GMT Strict Transport Security 365 days=31536000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) 8 issued: 5/8 secure, 3/8 HttpOnly Security headers X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'self' Cross-Origin-Opener-Policy: same-origin-allow-popups Cache-Control: max-age=0, must-revalidate, private Reverse Proxy banner -- Testing vulnerabilities Secure Renegotiation (RFC 5746) supported (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=254C538978E7F1E6FB3BA37FF702EB618BECA67B6F342706A0136C640F56FEC1 LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Done 2026-09-27 11:25:59 [ 53s] -->> 104.18.139.67:443 (www.chess.com) <<-- ----------------------------------------------------- Start 2026-09-27 11:26:00 -->> 104.18.140.67:443 (www.chess.com) <<-- Further IP addresses: 104.18.141.67 104.18.139.67 104.18.137.67 104.18.138.67 2606:4700::6812:8943 2606:4700::6812:8b43 2606:4700::6812:8d43 2606:4700::6812:8a43 2606:4700::6812:8c43 rDNS (104.18.140.67): -- Service detected: HTTP Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew 0 sec from localtime IPv4 address in header Set-Cookie: visitorid=%3A782d%3Affff%3A34.34.233.2; expires=Mon, 27 Sep 2027 11:26:26 GMT; Max-Age=31536000; path=/; httponly; samesite=lax (check if it's your IP address or e.g. a cluster IP) set-cookie: __cf_bm=GASRf6kk7yN.1GJbuQC34IBQxB6KzTKxYZVOHIDQjTU-1790508386.286107-1.0.1.1-ig7ph5kdbD01C.OOLdO3AoIj0EidZdQWJqzgAYTQODOGkrYvJACj6APeojF7X9kWiMInu43xudNSbuYpk.INGSj6eYS86qoR2bZZVbGOXI6TlBsxNzJAITz7pFdohlCT48EGZ4nyqDe1R0T.DLlGQA; HttpOnly; SameSite=None; Secure; Path=/; Domain=chess.com; Expires=Sun, 27 Sep 2026 11:56:26 GMT Strict Transport Security 365 days=31536000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) 8 issued: 5/8 secure, 3/8 HttpOnly Security headers X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'self' Cross-Origin-Opener-Policy: same-origin-allow-popups Cache-Control: max-age=0, must-revalidate, private Reverse Proxy banner -- Testing vulnerabilities Secure Renegotiation (RFC 5746) supported (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=254C538978E7F1E6FB3BA37FF702EB618BECA67B6F342706A0136C640F56FEC1 LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Done 2026-09-27 11:26:48 [ 102s] -->> 104.18.140.67:443 (www.chess.com) <<-- ----------------------------------------------------- Start 2026-09-27 11:26:48 -->> 104.18.137.67:443 (www.chess.com) <<-- Further IP addresses: 104.18.141.67 104.18.139.67 104.18.140.67 104.18.138.67 2606:4700::6812:8943 2606:4700::6812:8b43 2606:4700::6812:8d43 2606:4700::6812:8a43 2606:4700::6812:8c43 rDNS (104.18.137.67): -- Service detected: HTTP Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew 0 sec from localtime IPv4 address in header Set-Cookie: visitorid=%3A4881%3Affff%3A34.34.233.2; expires=Mon, 27 Sep 2027 11:27:24 GMT; Max-Age=31536000; path=/; httponly; samesite=lax (check if it's your IP address or e.g. a cluster IP) set-cookie: __cf_bm=xhUWoQQcBkQQB6WWlI8Qzswwl.Ot5gy6Kh9RUvtmrhk-1790508444.0886552-1.0.1.1-MA1f.sVX685TG_hsPBsg66HhI2l_OFV6XRkoZsIY4iB7avkYpdvGN_mIRaw.5cGP4SUTpbCQ2AfU0oBcdZOdTlGJNbC1Y_Qtv6AJG3iA4cn8Z2O2ArEQVeSHY99pABF5Jm5K05bAvD0VKI8SmjHgPA; HttpOnly; SameSite=None; Secure; Path=/; Domain=chess.com; Expires=Sun, 27 Sep 2026 11:57:24 GMT Strict Transport Security 365 days=31536000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) 8 issued: 5/8 secure, 3/8 HttpOnly Security headers X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'self' Cross-Origin-Opener-Policy: same-origin-allow-popups Cache-Control: max-age=0, must-revalidate, private Reverse Proxy banner -- Testing vulnerabilities Secure Renegotiation (RFC 5746) supported (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=254C538978E7F1E6FB3BA37FF702EB618BECA67B6F342706A0136C640F56FEC1 LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Done 2026-09-27 11:27:47 [ 160s] -->> 104.18.137.67:443 (www.chess.com) <<-- ----------------------------------------------------- Start 2026-09-27 11:27:47 -->> 104.18.138.67:443 (www.chess.com) <<-- Further IP addresses: 104.18.141.67 104.18.139.67 104.18.140.67 104.18.137.67 2606:4700::6812:8943 2606:4700::6812:8b43 2606:4700::6812:8d43 2606:4700::6812:8a43 2606:4700::6812:8c43 rDNS (104.18.138.67): -- Service detected: HTTP Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew 0 sec from localtime IPv4 address in header Set-Cookie: visitorid=%3Aea06%3Affff%3A34.34.233.2; expires=Mon, 27 Sep 2027 11:28:20 GMT; Max-Age=31536000; path=/; httponly; samesite=lax (check if it's your IP address or e.g. a cluster IP) set-cookie: __cf_bm=W8ibFnCiBqsCnBhJrB_hPLlBtiOK2M_yyn2XUuLrluk-1790508500.4086082-1.0.1.1-QQGZTH9lXaHOi_DnWtMd7hDKm0YGZISr_nKYrllvOsyVMdKM7mrH9skkW1NH4nupytFoKSR9uFOdzM36YvEKIQHGLKF.4JECK8gotAhua79KBMRcZEzF4LwBP9Yyf.ySAj0psoFT1pxYeYnviUvYIg; HttpOnly; SameSite=None; Secure; Path=/; Domain=chess.com; Expires=Sun, 27 Sep 2026 11:58:20 GMT Strict Transport Security 365 days=31536000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) 8 issued: 5/8 secure, 3/8 HttpOnly Security headers X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'self' Cross-Origin-Opener-Policy: same-origin-allow-popups Cache-Control: max-age=0, must-revalidate, private Reverse Proxy banner -- Testing vulnerabilities Secure Renegotiation (RFC 5746) supported (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=254C538978E7F1E6FB3BA37FF702EB618BECA67B6F342706A0136C640F56FEC1 LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Done 2026-09-27 11:28:43 [ 217s] -->> 104.18.138.67:443 (www.chess.com) <<-- ----------------------------------------------------- Start 2026-09-27 11:28:43 -->> 104.18.141.67:443 (www.chess.com) <<-- Further IP addresses: 104.18.139.67 104.18.140.67 104.18.137.67 104.18.138.67 2606:4700::6812:8943 2606:4700::6812:8b43 2606:4700::6812:8d43 2606:4700::6812:8a43 2606:4700::6812:8c43 rDNS (104.18.141.67): -- Service detected: HTTP Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew 0 sec from localtime IPv4 address in header Set-Cookie: visitorid=%3A7fca%3Affff%3A34.34.233.2; expires=Mon, 27 Sep 2027 11:29:15 GMT; Max-Age=31536000; path=/; httponly; samesite=lax (check if it's your IP address or e.g. a cluster IP) set-cookie: __cf_bm=Bz6z8S0qJZP62OTxirnG.z0.aqRE03_gOhI1ylEWuGw-1790508555.5022664-1.0.1.1-t5jIwO3O0HbJRjcm_.ljqF9sg8GQ20RNxEMMlLFVQJVvYWoLV.svWRIiaNKhlUyRQpyOucNSayDEbuRgE63rXCZ1koU7AcaNZ6tqe.knuHqbITX4iCd2PHlI.WE324iUFkEQJ8iz7P74S5gw.l3HhA; HttpOnly; SameSite=None; Secure; Path=/; Domain=chess.com; Expires=Sun, 27 Sep 2026 11:59:15 GMT Strict Transport Security 365 days=31536000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) 8 issued: 5/8 secure, 3/8 HttpOnly Security headers X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'self' Cross-Origin-Opener-Policy: same-origin-allow-popups Cache-Control: max-age=0, must-revalidate, private Reverse Proxy banner -- Testing vulnerabilities Secure Renegotiation (RFC 5746) supported (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=254C538978E7F1E6FB3BA37FF702EB618BECA67B6F342706A0136C640F56FEC1 LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs. Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Done 2026-09-27 11:29:38 [ 272s] -->> 104.18.141.67:443 (www.chess.com) <<-- ----------------------------------------------------- Done testing now all IP addresses (on port 443): 104.18.139.67 104.18.140.67 104.18.137.67 104.18.138.67 104.18.141.67
About this Scan
This scan uses testssl.sh to check for:
- Protocols: SSLv2, SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3
- Vulnerabilities: Heartbleed, POODLE, FREAK, Logjam, DROWN, etc.
- Cipher Suites: Weak ciphers, perfect forward secrecy (PFS) support.