SSL Certificate Analysis for caremark.com - Security Grade & TLS Configuration

Open Cached · just now

88/100 SECURITY SCORE

Detected Technologies

See all in URL Inspect 23

Adobe Target

Adobe Dynamic Tag Management

Adobe Experience Manager

Akamai Active incidents

AppDynamics

Bing

BootstrapCDN

Cloudflare

Cloudflare CDN

Contentful

Datadog

DigiCert

Google API JS Client

Google DoubleClick

Google Fonts

Google Tag Manager

jQuery

LaunchDarkly

OneTrust

Qualtrics

Quantum Metric

YouTube

Google App Engine

Certificate Information

Subject

UNKNOWN={:asn1_OPENTYPE, <<19, 2, 85, 83>>}, UNKNOWN={:asn1_OPENTYPE, <<19, 12, 82, 104, 111, 100, 101, 32, 73, 115, 108, 97, 110, 100>>}, UNKNOWN={:asn1_OPENTYPE, <<12, 20, 80, 114, 105, 118, 97, 116, 101, 32, 79, 114, 103, 97, 110, 105, 122, 97, 116, 105, 111, 110>>}, UNKNOWN=000014414, C=US, ST=Rhode Island, L=Woonsocket, O=CVS Pharmacy, Inc., CN=www.caremark.com

Issuer

C=US, O=DigiCert Inc, CN=DigiCert EV RSA CA G2

Valid From

May 14, 2026

Valid Until

November 25, 2026 95 days

Public Key

RSA 2048 bit Adequate

Signature Algorithm

SHA256-RSA

SHA-256 Fingerprint

09:47:64:DB:3D:FA:50:94:5A:AB:8F:3D:27:D4:C6:7B:43:E6:7B:2E:33:E4:F3:91:86:8D:47:F5:63:DB:98:25

Alternative Names

84 domains

Security Configuration

TLS Protocols

TLS 1.2 TLS 1.3

Forward Secrecy

Supported (Modern clients use PFS)

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000 ; includeSubDomains

Content-Security-Policy

Basic

default-src; script-src; frame-src; +1 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Present

SAMEORIGIN, SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

CAA Records (Certificate Authority Authorization)

CAA Records

Not Configured (Any CA can issue certificates)

CAA Issues

• No CAA records configured - any CA can issue certificates

Recommendations

• Implement CAA records to restrict which CAs can issue certificates for your domain
• This adds an extra layer of security against unauthorized certificate issuance
• Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
• Consider adding 'iodef' record to receive security incident reports