SSL Certificate Analysis for www.hallingkraft.no - Security Grade & TLS Configuration

Open Cached · just now

92/100 SECURITY SCORE

Certificate Information

Subject

CN=circoplastics.com

Issuer

C=US, O=Let's Encrypt, CN=R12

Valid From

October 30, 2025

Valid Until

January 28, 2026 47 days

Public Key

RSA 2048 bit Adequate

Signature Algorithm

SHA256-RSA

SHA-256 Fingerprint

1D:89:2B:02:D7:1D:60:47:1B:F8:84:23:7E:74:5F:8B:19:12:F7:80:8F:3E:8F:A0:6C:C8:52:1C:56:D5:65:8F

Alternative Names

67 domains

Security Configuration

TLS Protocols

TLS 1.2 TLS 1.3

Forward Secrecy

Supported (Modern clients use PFS)

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31557600; includeSubDomains

Content-Security-Policy

Good

default-src; connect-src; font-src; +6 more

default-src 'self'; connect-src 'self' *.linkapp.no *.fortum.no *.fortum.com https://fortumno.boost.ai/ *.livechatinc.com *.pingdom.net https://*.clarity.ms sc-static.net *.snapchat.com cdn.cookielaw.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://*.google.com https://*.google.no https://*.google.se https://*.google.fi privacyportal-eu.onetrust.com *.onetrust.com cdn.horizons.confirmit.eu api.puzzel.com euwa.puzzel.com *.abtasty.com; font-src 'self'; img-src 'self' data: *.linkapp.no *.fortum.no *.fortum.com https://fortumno.boost.ai/ https://boost-files-general-eu-west-1-prod.s3-eu-west-1.amazonaws.com *.livechatinc.com https://*.clarity.ms sc-static.net *.snapchat.com cdn.cookielaw.org *.googletagmanager.com https://*.google-analytics.com https://ssl.gstatic.com https://www.gstatic.com https://*.g.doubleclick.net https://ad.doubleclick.net https://ade.googlesyndication.com https://*.google.com https://google.com https://*.google.no https://*.google.se https://*.google.fi https://*.fls.doubleclick.net www.facebook.com epost.fortum.no strom.fortum.no https://*.siteimproveanalytics.io *.abtasty.com bat.bing.com c.bing.com; script-src 'self' 'unsafe-inline' *.linkapp.no *.fortum.no *.fortum.com https://fortumno.boost.ai/ *.livechatinc.com *.pingdom.net https://*.clarity.ms https://c.bing.com sc-static.net *.snapchat.com cdn.cookielaw.org https://*.googletagmanager.com https://tagmanager.google.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com connect.facebook.net in.taskanalytics.com cdn.horizons.confirmit.eu horizons.confirmit.eu https://siteimproveanalytics.com bat.bing.com euwa.puzzel.com api.puzzel.com try.abtasty.com blob: *.abtasty.com; child-src 'self' *.linkapp.no *.fortum.no *.fortum.com https://fortumno.boost.ai/ *.livechatinc.com data: ; frame-src 'self' *.linkapp.no *.fortum.no *.fortum.com https://fortumno.boost.ai/ *.livechatinc.com sc-static.net *.snapchat.com player.vimeo.com/video/ www.youtube.com/embed/ horizons.confirmit.eu *.doubleclick.net https://*.fls.doubleclick.net; frame-ancestors 'self' *.linkapp.no *.fortum.com; style-src 'self' 'unsafe-inline'

X-Frame-Options

Excellent

deny

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Strengthen CSP by removing 'unsafe-eval'
• Consider adding Permissions-Policy to control browser features

CAA Records (Certificate Authority Authorization)

CAA Records

Not Configured (Any CA can issue certificates)

CAA Issues

• No CAA records configured - any CA can issue certificates

Recommendations

• Implement CAA records to restrict which CAs can issue certificates for your domain
• This adds an extra layer of security against unauthorized certificate issuance
• Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
• Consider adding 'iodef' record to receive security incident reports