SSL Certificate Analysis for airnzparking.co.nz - Security Grade & TLS Configuration

Open Cached · just now

94/100 SECURITY SCORE

Certificate Information

Subject

CN=www.airnewzealand.co.nz

Issuer

C=US, O=Amazon, CN=Amazon RSA 2048 M04

Valid From

November 19, 2025

Valid Until

December 18, 2026 373 days

Public Key

RSA 2048 bit Adequate

Signature Algorithm

SHA256-RSA

SHA-256 Fingerprint

91:DD:A9:A2:EB:C9:E0:14:D1:1F:60:64:AB:94:7B:FC:E2:18:68:34:CC:DD:5F:57:8E:7B:8D:A8:DB:0B:E1:A1

Alternative Names

97 domains

Security Configuration

TLS Protocols

TLS 1.2 TLS 1.3

Forward Secrecy

Supported (Modern clients use PFS)

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31536000

Content-Security-Policy

Basic

block-all-mixed-content; default-src; base-uri; +12 more

block-all-mixed-content; default-src 'self'; base-uri 'self'; form-action 'self' flightbookings.airnewzealand.ca flightbookings.airnewzealand.cn flightbookings.airnewzealand.co.jp flightbookings.airnewzealand.co.kr flightbookings.airnewzealand.co.nz flightbookings.airnewzealand.co.uk flightbookings.airnewzealand.com flightbookings.airnewzealand.com.au flightbookings.airnewzealand.com.cn flightbookings.airnewzealand.com.hk flightbookings.airnewzealand.com.sg flightbookings.airnewzealand.com.tw flightbookings.airnewzealand.eu flightbookings.airnewzealand.hk flightbookings.airnewzealand.jp flightbookings.airnewzealand.kr flightbookings.airnewzealand.pf flightbookings.airnewzealand.tw flightbookings.grabaseat.co.nz govtbookings.airnewzealand.co.nz txn.apac.paywithpoli.com online.asb.co.nz bank.westpac.co.nz checkoutshopper-test.adyen.com checkoutshopper-live-au.adyen.com test.adyen.com au-connect.authsignal.com auth.identity.airnewzealand.com auth.identity.qual.airnewzealand.com; script-src 'self' p-airnz.com 'unsafe-inline' 'unsafe-eval' *.airnewzealand.co.nz musculahq.appspot.com dnn506yrbagrg.cloudfront.net xsell.expedia.com ddc.optimahub.com www.newzealand.com *.demdex.net www.everestjs.net oc-cdn-public-oce.azureedge.net https://unpkg.com/[email protected]/dist/chat-adapter.js www.googleadservices.com www.google.com www.googletagmanager.com pagead2.googlesyndication.com googleads.g.doubleclick.net *.googleapis.com *.gstatic.com *.google.com *.ggpht.com *.googleusercontent.com www.google-analytics.com analytics.google.com tagmanager.google.com *.doubleclick.net static.hotjar.com script.hotjar.com https://widget.timatic.iata.org/scripts/iata-timatic-widget-live.js md-scp.kampyle.com sbt-prod.kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com analytics-fe.digital-cloud-syd1.medallia.com.au cdn-au.onetrust.com cdn-assets-prod.s3.amazonaws.com *.optimizely.com optimizely-hrd.appspot.com optimizely.s3.amazonaws.com upgrade.plusgrade.com s.swiftypecdn.com s.wayin.com xd.wayin.com x.wayin.com eu-x.wayin.com s.engagesciences.com display.engagesciences.com display.wayin.com yourir.info www.youtube.com s.ytimg.com; style-src 'unsafe-inline' p-airnz.com 'self' oc-cdn-public-oce.azureedge.net fonts.googleapis.com tagmanager.google.com static.hotjar.com script.hotjar.com upgrade-cdn-prd.plusgrade.com upgrade-prod-cdn.plusgrade.com s.swiftypecdn.com yourir.info; img-src https: data: blob: ad.doubleclick.net ade.googlesyndication.com adservice.google.com www.googletagmanager.com www.google.com static.hotjar.com script.hotjar.com *.kampyle.com i.ytimg.com; font-src p-airnz.com 'self' *.cdn.office.net fonts.googleapis.com fonts.gstatic.com script.hotjar.com data: dhm5hy2vn8l0l.cloudfront.net; media-src 'self' p-airnz.com data:; frame-src 'self' txn.apac.paywithpoli.com online.asb.co.nz bank.westpac.co.nz sec.windcave.com uat.windcave.com checkoutshopper-test.adyen.com checkoutshopper-live-au.adyen.com test.adyen.com airnz-cargo.chooose.today airnz-corporate.chooose.today emissions-platform.airnewzealand.co.nz airpointscalculator.co.nz *.airnewzealand.co.nz hotels.airnewzealand.co.nz *.demdex.net www.everestjs.net pixel.everesttech.net au-connect.authsignal.com auth.identity.airnewzealand.com identity.airnewzealand.com oc-cdn-public-oce.azureedge.net blob: comms.omnichannelengagementhub.com customervoice.microsoft.com www.googletagmanager.com td.doubleclick.net *.google.com *.doubleclick.net vars.hotjar.com nebula-cdn.kampyle.com *.cdn-pci.optimizely.com nz.fltmaps.com xd.wayin.com x.wayin.com eu-x.wayin.com display.engagesciences.com airnz.wufoo.com www.youtube.com; worker-src blob:; connect-src 'self' api.airnz.io api.airnz.ai p-airnz.com sec.windcave.com uat.windcave.com checkoutshopper-test.adyen.com checkoutshopper-live-au.adyen.com muscula.herokuapp.com tourismnz.sc.omtrdc.net *.demdex.net *.tt.omtrdc.net identity.airnewzealand.com unq0355446423e84eb397bc71189d78d-crm6.omnichannelengagementhub.com browser.pipe.aria.microsoft.com *.omnichannelengagementhub.com *.au.omnichannelengagementhub.com https://*.trouter.skype.com wss://*.trouter.skype.com edge.skype.com *.communication.azure.com ocsdk-prod.azureedge.net blob: pagead2.googlesyndication.com www.googleadservices.com www.google.com google.com ad.doubleclick.net *.googleapis.com *.google.com *.gstatic.com www.google-analytics.com region1.google-analytics.com region1.analytics.google.com analytics.google.com stats.g.doubleclick.net https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://widget.timatic.iata.org/api/ md-scp.kampyle.com sbt-prod.kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com analytics-fe.digital-cloud-syd1.medallia.com.au cdn-au.onetrust.com geolocation.onetrust.com privacyportal-au.onetrust.com *.optimizely.com https://*.sentry.io s.swiftypecdn.com search-api.swiftype.com yourir.info; object-src 'none'; frame-ancestors 'self' www.airnewzealand.com.au www.airnewzealand.com www.airnewzealand.ca www.airnewzealand.co.uk www.airnewzealand.eu www.airnewzealand.co.jp www.airnewzealand.jp www.airnewzealand.com.sg www.airnewzealand.pf www.airnewzealand.cn www.airnewzealand.com.cn www.airnewzealand.hk www.airnewzealand.com.hk www.airnewzealand.tw www.airnewzealand.com.tw www.airnewzealand.co.kr www.airnewzealand.kr www.grabaseat.co.nz flightbookings.airnewzealand.ca flightbookings.airnewzealand.cn flightbookings.airnewzealand.co.jp flightbookings.airnewzealand.co.kr flightbookings.airnewzealand.co.nz govtbookings.airnewzealand.co.nz flightbookings.airnewzealand.co.uk flightbookings.airnewzealand.com.au flightbookings.airnewzealand.com flightbookings.airnewzealand.com.cn flightbookings.airnewzealand.com.hk flightbookings.airnewzealand.com.sg flightbookings.airnewzealand.com.tw flightbookings.airnewzealand.eu flightbookings.airnewzealand.hk flightbookings.airnewzealand.jp flightbookings.airnewzealand.kr flightbookings.airnewzealand.pf flightbookings.airnewzealand.tw flightbookings.grabaseat.co.nz; report-uri /csp-report

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin

Permissions-Policy

Present

geolocation=(self "https://p-airnz.com"), camera=(), fullscreen=(self "https://www.youtube.com"), accelerometer=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), sync-xhr=(*), usb=(), web-share=(self), clipboard-read=(), clipboard-write=()

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'

CAA Records (Certificate Authority Authorization)

CAA Records

Configured (Restricts certificate issuance)

Current Issuer

Authorized (Matches CAA policy)

Authorized CAs

amazon.com amazonaws.com amazontrust.com awstrust.com

Recommendations

• Consider using critical flag (flags=128) for stricter CAA enforcement
• You have authorized 4 CAs - consider limiting to only the CAs you actively use
• Consider adding 'iodef' records to receive notifications about unauthorized certificate issuance attempts
• Consider adding 'issuewild' records to control wildcard certificate issuance