SSL Certificate Analysis for virtualspaces.pwc.com - Security Grade & TLS Configuration

Open Cached · just now

92/100 SECURITY SCORE

Certificate Information

Subject

CN=imperva.com

Issuer

C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4

Valid From

December 05, 2025

Valid Until

June 03, 2026 158 days

Public Key

RSA 2048 bit Adequate

Signature Algorithm

SHA256-RSA

SHA-256 Fingerprint

5A:D6:5A:4F:2D:08:30:21:33:2E:54:5C:07:53:C3:2E:F5:11:7B:0F:50:A1:FE:69:20:96:89:B0:66:27:ED:29

Alternative Names

152 domains

Security Configuration

TLS Protocols

TLS 1.2 TLS 1.3

Forward Secrecy

Supported (Modern clients use PFS)

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

Basic

default-src; object-src; style-src; +5 more

default-src 'self' data:; object-src https://sta02prodvworldprod07020.blob.core.windows.net https://sta03prodvworldprod07020.blob.core.windows.net; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: https://cdnjs.cloudflare.com; connect-src 'self' blob: https://*.virtualspaces.pwc.com https://*.ext.virtualworld.stg.codemelter.pwc.de https://sta02prodvworldprod07020.blob.core.windows.net https://sta03prodvworldprod07020.blob.core.windows.net wss://rehs.virtualspaces.pwc.com https://*.gstatic.com wss://*.twilio.com https://*.twilio.com https://*.sentry.io https://login.pwc.com https://*.akamaized.net https://*.daserste.de https://*.pwc.de https://*.pwc.com https://*.blob.core.windows.net https://*.google.com https://*.youtube.com https://*.vimeo.com https://*.windows.net https://*.twitch.tv https://*.pwcinternal.com https://*.pwc.to https://*.video-stream-hosting.de rtmp://*.kaltura.com rtmp://*.mediacdn.com https://storage.googleapis.com https://gitlab.com;; frame-src *.blob.core.windows.net *.ext.virtualworld.stg.codemelter.pwc.de app.mural.co/ www.youtube.com pwc.talentry.com/ app.sli.do/ miro.com/ *.google.com/ *.vimeo.com/ *.office.com *.pwc.to *.pwc.de streaming.pwc.de *.pwc.com *.pwcplus.de *.pwcinternal.com *.pwcglb.com *.asana.com https://padlet.com https://*.padlet.com *.spotify.com *.akamaized.net *.twitch.tv *.linkedin.com *.xing.com *.ondemand.com *.myshn.net *.workfront.com *.myworkday.com *.kaltura.com *.atlassian.com *.atlassian.net *.sharepoint.com teams.microsoft.com playground.metus.de/; img-src 'self' data: blob: https://sta02prodvworldprod07020.blob.core.windows.net https://sta03prodvworldprod07020.blob.core.windows.net https://cdn.jsdelivr.net/npm/; media-src 'self' data: blob: https://sta02prodvworldprod07020.blob.core.windows.net https://sta03prodvworldprod07020.blob.core.windows.net https://*.akamaized.net https://*.daserste.de https://*.pwc.de https://*.pwc.com https://*.blob.core.windows.net https://*.google.com https://*.youtube.com https://*.vimeo.com;

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

no-referrer

Permissions-Policy

Missing

Not configured

Recommendations

• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Consider adding Permissions-Policy to control browser features

CAA Records (Certificate Authority Authorization)

CAA Records

Not Configured (Any CA can issue certificates)

CAA Issues

• No CAA records configured - any CA can issue certificates

Recommendations

• Implement CAA records to restrict which CAs can issue certificates for your domain
• This adds an extra layer of security against unauthorized certificate issuance
• Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
• Consider adding 'iodef' record to receive security incident reports