SSL Certificate Analysis for xactware.com - Security Grade & TLS Configuration

Open Cached · just now

91/100 SECURITY SCORE

Certificate Information

Subject

CN=imperva.com

Issuer

C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4

Valid From

January 02, 2026

Valid Until

July 01, 2026 164 days

Public Key

RSA 2048 bit Adequate

Signature Algorithm

SHA256-RSA

SHA-256 Fingerprint

C6:C1:9C:69:63:E3:F4:56:65:07:CA:01:25:CF:C2:78:01:A8:9F:33:EB:0F:2F:B2:BC:0E:D7:0B:9C:D5:BA:CB

Alternative Names

103 domains

Security Configuration

TLS Protocols

TLS 1.2 TLS 1.3

Forward Secrecy

Supported (Modern clients use PFS)

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains

Content-Security-Policy

Basic

default-src; child-src; connect-src; +12 more

default-src 'none'; child-src 'self' *.kaltura.com *.surveygizmo.com cdn.calconic.com insuranceservicesofficeinc.demdex.net; connect-src 'self' data: *.albacross.com *.brightcove.com *.clarity.ms *.commoninja.com *.crazyegg.com *.facebook.com *.g.doubleclick.net *.google-analytics.com *.google.com *.googleapis.com *.googlesyndication.com *.kaltura.com *.kampyle.com *.linkedin.com *.maplecroft.com *.optimizely.com *.srv.stackadapt.com *.xactware.com app.calconic.com bcbolt446c5271-a.akamaihd.net cdn-app.continual.ly cdn.calconic.com cdn.cookielaw.org dc.services.visualstudio.com dl.episerver.net dpm.demdex.net geolocation.onetrust.com google.co.in http://ad.doubleclick.net https://*.influ2.com https://1752680588.rsc.cdn77.org https://adservice.google.com https://analytics-fe.digital-cloud-us-main.medallia.com https://analytics.google.com https://api.adblocking247.com https://api.aituria.com https://api.awesomeblocker.com https://api.killadsapi.com https://app.continual.ly/ https://cdn.linkedin.oribi.io/partner/1669474/domain/verisk.com/token https://cdn.linkedin.oribi.io/partner/384036/domain/maplecroft.com/token https://content.hotjar.io https://js.monitor.azure.com https://metrics.hotjar.io https://s.yimg.com https://statistics-dot-calconic-app.appspot.com/api/stats/push https://unpkg.com https://verisk.my.salesforce-scrt.com https://wss-pr.continual.ly:6001 https://www.google.com.et https://www.google.com.pr https://www.google.com.tr hubspot-forms-static-embed.s3.amazonaws.com manifest.prod.boltdns.net opreq.observepoint.com privacyportal.onetrust.com public.flourish.studio secure.adnxs.com vc.hotjar.io verisk.d1.sc.omtrdc.net veriskisonetprod.112.2o7.net ws.hotjar.com wss://ws.hotjar.com; font-src 'self' data: *.cloudfront.net *.googleapis.com *.gstatic.com *.kaltura.com cdnjs.cloudflare.com dl.episerver.net vjs.zencdn.net; frame-src 'self' *.acast.com *.brightcove.net *.commoninja.com *.eloqua.com *.facebook.com *.g.doubleclick.net *.google.com *.gstatic.com *.kaltura.com *.kampyle.com *.maplecroft.com *.optimizely.com *.pardot.com *.readymag.com *.surveygizmo.com *.twitter.com *.youtube.com activitymap.adobe.com app.powerbi.com bloomberg.com capture.navattic.com cdn-app.continual.ly cdn.calconic.com datawrapper.dwcdn.net dl.episerver.net flo.uri.sh https://app.continual.ly/ https://open.spotify.com https://verisk.my.site.com https://view.ceros.com https://www.brighttalk.com https://www.googletagmanager.com insuranceservicesofficeinc.demdex.net lifedemo.shinyapps.io optimize.google.com player.vimeo.com public.tableau.com survey.alchemer.com td.doubleclick.net verisk.postclickmarketing.com www.buzzsprout.com www.google.com www.insurancejournal.tv www.youtube-nocookie.com; img-src 'self' data: *.air-worldwide.com *.albacross.com *.brightcove.com *.clarity.ms *.commoninja.com *.eloqua.com *.facebook.com *.g.doubleclick.net *.google-analytics.com *.googleapis.com *.googletagmanager.com *.gstatic.com *.kaltura.com *.kampyle.com *.linkedin.com *.maplecroft.com *.optimizely.com *.srv.stackadapt.com *.trendemon.com *.twimg.com *.twitter.com *.verisk.com *.youtube.com 6016449.global.siteimproveanalytics.io api.mapbox.com assets.adobedtm.com c.bing.com cdn.cookielaw.org cf-images.us-east-1.prod.boltdns.net cm.everesttech.net dl.episerver.net dpm.demdex.net https://ib.adnxs.com https://sp.analytics.yahoo.com i.ytimg.com jumbe.zaius.com maps.gstatic.com optimize.google.com p.adsymptotic.com public.tableau.com t.influ2.com verisk.d1.sc.omtrdc.net veriskisonetprod.112.2o7.net w3.poweradvocate.com www.google.co.uk www.google.com www.greatplacetowork.com www.gstatic.com; media-src 'self' blob: *.air-worldwide.com *.gstatic.com *.kaltura.com *.srv.stackadapt.com bcbolt446c5271-a.akamaihd.net dl.episerver.net manifest.prod.boltdns.net; script-src-elem 'self' 'unsafe-inline' *.albacross.com *.cave9tape.com *.clarity.ms *.cloudfront.net *.cookielaw.org *.facebook.com *.facebook.net *.g.doubleclick.net *.google-analytics.com *.google.com *.googleapis.com *.googletagmanager.com *.gstatic.com *.kaltura.com *.kampyle.com *.licdn.com *.maplecroft.com *.oktopost.com *.salesforceliveagent.com *.srv.stackadapt.com *.trendemon.com *.twitter.com *.xactware.com alert.risksolutions.verisk.com assets.adobedtm.com cdn-app.continual.ly cdn.calconic.com cdn.datatables.net cdnjs.cloudflare.com code.jquery.com dl.episerver.net https://*.influ2.com https://app.optimizely.com https://cdn-assets-prod.s3.amazonaws.com https://cdn.optimizely.com https://cdnapisec.kaltura.com https://okt.to https://s.yimg.com https://script.hotjar.com https://static.hotjar.com https://unpkg.com https://verisk.my.site.com https://view.ceros.com https://www.brighttalk.com img.en25.com js.monitor.azure.com maxcdn.bootstrapcdn.com public.flourish.studio risksolutions.verisk.com siteimproveanalytics.com static.oktopost.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.ads-twitter.com *.albacross.com *.cave9tape.com *.cloudflare.com *.cloudfront.net *.commoninja.com *.cookielaw.org *.facebook.net *.fraudblocker.com *.g.doubleclick.net *.google-analytics.com *.google.com *.googleapis.com *.googletagmanager.com *.gstatic.com *.herbgreencolumn.com *.hsforms.com *.kaltura.com *.licdn.com *.linkedin.com *.maplecroft.com *.oktopost.com *.optimizely.com *.pardot.com *.readymag.com *.salesforceliveagent.com *.trendemon.com *.twimg.com *.twitter.com *.xactware.com *.youtube.com activitymap.adobe.com api-ssl.bitly.com az416426.vo.msecnd.net cdn-app.continual.ly cdn-assets-prod.s3.amazonaws.com cdn.calconic.com cdn.mouseflow.com cdnjs.cloudflare.com code.jquery.com dl.episerver.net geolocation.onetrust.com https://js.monitor.azure.com img.en25.com ionfiles.scribblecdn.ne js.hsforms.net js.monitor.azure.com maxcdn.bootstrapcdn.com optimize.google.com player.vimeo.com players.brightcove.net public.flourish.studio public.tableau.com s1065293013.t.eloqua.com script.crazyegg.com secure.leadforensics.com siteimproveanalytics.com unpkg.com vjs.zencdn.net www.buzzsprout.com www.googleadservices.com www.googleanalytics.com www.googleoptimize.com www.gstatic.com; style-src-elem 'self' 'unsafe-inline' *.googleapis.com *.gstatic.com *.srv.stackadapt.com *.verisk.com alert.risksolutions.verisk.com cdn-app.continual.ly cdn.jsdelivr.net dl.episerver.net https://app.continual.ly/css/gekr8k83y6vw/custom.css https://cdnjs.cloudflare.com https://unpkg.com https://verisk.my.site.com risksolutions.verisk.com; style-src 'self' 'unsafe-inline' *.googleapis.com *.gstatic.com *.srv.stackadapt.com *.twimg.com *.twitter.com *.verisk.com cdn-app.continual.ly cdn.jsdelivr.net cdnjs.cloudflare.com dl.episerver.net optimize.google.com unpkg.com; worker-src 'self' blob:; script-src-attr 'unsafe-inline' *.srv.stackadapt.com *.xactware.com; report-to stott-security-endpoint;report-uri https://www.verisk.com/stott.security.optimizely/api/cspreporting/reporturiviolation/;

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Present

same-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Consider adding Permissions-Policy to control browser features

CAA Records (Certificate Authority Authorization)

CAA Records

Not Configured (Any CA can issue certificates)

CAA Issues

• No CAA records configured - any CA can issue certificates

Recommendations

• Implement CAA records to restrict which CAs can issue certificates for your domain
• This adds an extra layer of security against unauthorized certificate issuance
• Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
• Consider adding 'iodef' record to receive security incident reports

Subject Alternative Names

103 domains

xactware.com *.xactware.com *.g1.xactware.com

Other domains in certificate

ppw.altisource.com ppwtest.altisource.com

*.euc1.prod.claims-sol.io *.euw1.prod.claims-sol.io *.g0.prod.claims-sol.io *.g1.prod.claims-sol.io kong.external.euw1.prod.claims-sol.io kong.external.usw2.prod.claims-sol.io *.notification.euw1.prod.claims-sol.io *.notification.usw2.prod.claims-sol.io *.use1.prod.claims-sol.io *.usw2.prod.claims-sol.io

claimxperience.co.uk *.claimxperience.co.uk

claimxperience.com *.claimxperience.com

beta.contentscollaboration.com contentscollaboration.com www.contentscollaboration.com

contentstrack.com *.contentstrack.com *.g1.contentstrack.com

estimateon.com www.estimateon.com

imperva.com

*.inspectionmanager.net

intuitivemobile.com *.intuitivemobile.com

onexperience.com *.onexperience.com

propertypreswizard.com *.propertypreswizard.com test.propertypreswizard.com www.propertypreswizard.com

*.punchlistmanager.net

*.restorationmanager.net

servicesoftwareinc.com *.servicesoftwareinc.com

testclaimxperience.co.uk *.testclaimxperience.co.uk

testclaimxperience.com *.testclaimxperience.com

testonexperience.com *.testonexperience.com

*.accept.cia.claims.verisk.com *.accept.property.claims.verisk.com *.accept.visc.claims.verisk.com *.cia.claims.verisk.com *.dev.cia.claims.verisk.com *.dev.property.claims.verisk.com *.property.claims.verisk.com *.test.cia.claims.verisk.com *.test.property.claims.verisk.com *.test.visc.claims.verisk.com *.verisk.com *.visc.claims.verisk.com

*.veriskallyne.com

*.external.euw1.prod.vis-claims.com *.external.use1.test.vis-claims.com kong.external.use1.prod.vis-claims.com *.pipelines.dev.vis-claims.com *.vis-claims.com

axa.g1.xactanalysis.com beta.g1.xactanalysis.com edi.g1.xactanalysis.com *.g1.xactanalysis.com sf.xactanalysis.com stage.g1.xactanalysis.com www.xactanalysis.com xactanalysis.com *.xactanalysis.com

appsbeta.xactcontents.com appsdev.xactcontents.com awsprod.xactcontents.com xactcontents.com *.xactcontents.com

*.external.euw1.accept.xactdev.com *.external.usw2.accept.xactdev.com *.external.usw2.dev.xactdev.com *.external.usw2.test.xactdev.com *.g0.accept.xactdev.com *.g0.dev.xactdev.com *.g0.test.xactdev.com *.g1.accept.xactdev.com *.g1.test.xactdev.com *.notification.euw1.accept.xactdev.com *.notification.usw2.accept.xactdev.com

awsprod.xactimate.com commonitems.xactimate.com *.g0.xactimate.com *.g1.xactimate.com xactimate.com *.xactimate.com

*.xactnet.com

www.xactprm.com xactprm.com

*.xactwaretrainingresources.com

*.xwmobile.io