{"sprite": "arclab-arc-custom", "role": "arc-custom", "title": "ARC #3: your settings", "host": "arclab-arc-custom-b2rc4.sprites.app", "url": "https://arclab-arc-custom-b2rc4.sprites.app", "uptime_s": 2551, "config": {"profile": "device", "kex": "rsa-only", "custom": {"cn": "Wavetronix Custom", "key_type": "rsa", "key_usage": ["digitalSignature", "keyEncipherment"], "ku_critical": true}}, "config_version": 6, "config_error": null, "kex": {"id": "rsa-only", "title": "RSA key transport only (today's ARC firmware)", "blurb": "The ARC only knows the old way: the phone encrypts the session secret with the ARC's certificate key. The certificate must therefore allow Key Encipherment.", "max_tls": "1.2", "cipher_lists": {"443": [{"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}], "10443": [{"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}]}}, "cert": {"subject": "Wavetronix Device", "subject_org": "Wavetronix", "issuer": "Wavetronix Lab Root CA", "issuer_org": "Wavetronix Lab", "publicly_trusted": false, "serial": "1c16e8821501ad9485ac199701d7d124684c368e", "not_before": "2026-10-11T05:15:47+00:00", "not_after": "2029-01-14T05:15:47+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "nonRepudiation"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Content Commitment (Non-Repudiation)"], "extended_key_usage": ["serverAuth", "clientAuth"], "sans": ["arclab-arc-custom-b2rc4.sprites.app", "arclab-arc-custom", "localhost", "127.0.0.1"], "sha256": "a1cd7106efd615bc6604ec25e321dfc15e9b554a04d9ced4ad861030b9df2012", "may_encrypt_secret": false, "may_sign": true}, "profiles": {"arc": {"title": "Wavetronix Arc (working ARC)", "short": "Wavetronix Arc", "blurb": "The certificate found on ARC devices that work with the app. It has NO Key Usage extension, so nothing restricts how its key may be used.", "available": true}, "device": {"title": "Wavetronix Device (failing ARC)", "short": "Wavetronix Device", "blurb": "The certificate found on ARC devices that fail. Its Key Usage extension allows Digital Signature and Content Commitment only, NOT Key Encipherment.", "available": true, "cert": {"subject": "Wavetronix Device", "subject_org": "Wavetronix", "issuer": "Wavetronix Lab Root CA", "issuer_org": "Wavetronix Lab", "publicly_trusted": false, "serial": "1c16e8821501ad9485ac199701d7d124684c368e", "not_before": "2026-10-11T05:15:47+00:00", "not_after": "2029-01-14T05:15:47+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "nonRepudiation"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Content Commitment (Non-Repudiation)"], "extended_key_usage": ["serverAuth", "clientAuth"], "sans": ["arclab-arc-custom-b2rc4.sprites.app", "arclab-arc-custom", "localhost", "127.0.0.1"], "sha256": "a1cd7106efd615bc6604ec25e321dfc15e9b554a04d9ced4ad861030b9df2012", "may_encrypt_secret": false, "may_sign": true}}, "fixed": {"title": "Wavetronix Device, re-issued with Key Encipherment", "short": "Wavetronix Device (fixed)", "blurb": "Same certificate as the failing one but with Key Encipherment added. This is what public CAs issue for RSA keys.", "available": true, "cert": {"subject": "Wavetronix Device", "subject_org": "Wavetronix", "issuer": "Wavetronix Lab Root CA", "issuer_org": "Wavetronix Lab", "publicly_trusted": false, "serial": "e6bc00efa3e928e3a62853bc63ba2465cf4e5b", "not_before": "2026-10-11T05:27:40+00:00", "not_after": "2029-01-14T05:27:40+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "keyEncipherment"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Key Encipherment"], "extended_key_usage": ["serverAuth", "clientAuth"], "sans": ["arclab-arc-custom-b2rc4.sprites.app", "arclab-arc-custom", "localhost", "127.0.0.1"], "sha256": "a1af9e6a23e57ad204e0e67bcc2e7cecc0fff5caf8d6e4187b90cbd2c9ce11fd", "may_encrypt_secret": true, "may_sign": true}}, "le-rsa": {"title": "Let's Encrypt, RSA key (real, publicly trusted)", "short": "Let's Encrypt RSA", "blurb": "A real certificate from Let's Encrypt for this ARC's public hostname, with an RSA key. Public CAs always add Key Encipherment to RSA certificates.", "available": true, "cert": {"subject": "arclab-arc-custom-b2rc4.sprites.app", "subject_org": "", "issuer": "YR1", "issuer_org": "Let's Encrypt", "publicly_trusted": true, "serial": "52ad6ab6aeded2b58b983a5c766b578095e", "not_before": "2026-10-12T04:24:08+00:00", "not_after": "2027-01-10T04:24:07+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "keyEncipherment"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Key Encipherment"], "extended_key_usage": ["serverAuth"], "sans": ["arclab-arc-custom-b2rc4.sprites.app"], "sha256": "720d5743d61d8adfcdbcade60af24c6b4bf5e359f978aa21fb2ebada159a1913", "may_encrypt_secret": true, "may_sign": true}}, "le-ecdsa": {"title": "Let's Encrypt, ECDSA key (real, publicly trusted)", "short": "Let's Encrypt ECDSA", "blurb": "A real Let's Encrypt certificate with an ECDSA key. ECDSA keys cannot do RSA key transport at all, so an ARC using it MUST support ECDHE.", "available": true, "cert": {"subject": "arclab-arc-custom-b2rc4.sprites.app", "subject_org": "", "issuer": "YE1", "issuer_org": "Let's Encrypt", "publicly_trusted": true, "serial": "586636126bb6a0daa108eb263fdf3636d9f", "not_before": "2026-10-12T04:24:12+00:00", "not_after": "2027-01-10T04:24:11+00:00", "key_type": "ECDSA (secp256r1)", "key_bits": 256, "key_usage": ["digitalSignature"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature"], "extended_key_usage": ["serverAuth"], "sans": ["arclab-arc-custom-b2rc4.sprites.app"], "sha256": "8a6f6c6ef0c271711c9e133714788cd57f43dadc6e62860d0e26f0e03de85112", "may_encrypt_secret": false, "may_sign": true}}, "custom": {"title": "Custom certificate (build your own)", "short": "Custom", "blurb": "Pick the key type and the Key Usage bits yourself and see what happens.", "available": true}}, "kex_modes": {"rsa-only": {"title": "RSA key transport only (today's ARC firmware)", "blurb": "The ARC only knows the old way: the phone encrypts the session secret with the ARC's certificate key. The certificate must therefore allow Key Encipherment."}, "ecdhe": {"title": "ECDHE enabled, TLS 1.2 (RSA key transport kept as fallback)", "blurb": "The ARC prefers ephemeral Diffie-Hellman: the certificate key only signs. Digital Signature is enough, and every session gets forward secrecy."}, "tls13": {"title": "TLS 1.3 (ECDHE for TLS 1.2 clients)", "blurb": "Modern TLS: key transport no longer exists, the certificate key is only ever used to sign."}}, "listeners": [{"port": 443, "service": "HTTPS REST API"}, {"port": 10443, "service": "EMP"}], "counters": {"ok": 26, "failed": 30}, "recent": [{"ts": 1791789393.9227538, "time": "2026-10-12T07:16:33.922+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:60708", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x00A3", "name": "UNKNOWN_0x00A3", "kex": "other"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC0AD", "name": "UNKNOWN_0xC0AD", "kex": "other"}, {"id": "0xC09F", "name": "UNKNOWN_0xC09F", "kex": "other"}, {"id": "0xC05D", "name": "UNKNOWN_0xC05D", "kex": "other"}, {"id": "0xC061", "name": "UNKNOWN_0xC061", "kex": "other"}, {"id": "0xC057", "name": "UNKNOWN_0xC057", "kex": "other"}, {"id": "0xC053", "name": "UNKNOWN_0xC053", "kex": "other"}, {"id": "0x00A7", "name": "UNKNOWN_0x00A7", "kex": "other"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x00A2", "name": "UNKNOWN_0x00A2", "kex": "other"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC0AC", "name": "UNKNOWN_0xC0AC", "kex": "other"}, {"id": "0xC09E", "name": "UNKNOWN_0xC09E", "kex": "other"}, {"id": "0xC05C", "name": "UNKNOWN_0xC05C", "kex": "other"}, {"id": "0xC060", "name": "UNKNOWN_0xC060", "kex": "other"}, {"id": "0xC056", "name": "UNKNOWN_0xC056", "kex": "other"}, {"id": "0xC052", "name": "UNKNOWN_0xC052", "kex": "other"}, {"id": "0x00A6", "name": "UNKNOWN_0x00A6", "kex": "other"}, {"id": "0xC0AF", "name": "UNKNOWN_0xC0AF", "kex": "other"}, {"id": "0xC0AE", "name": "UNKNOWN_0xC0AE", "kex": "other"}, {"id": "0xC0A3", "name": "UNKNOWN_0xC0A3", "kex": "other"}, {"id": "0xC0A2", "name": "UNKNOWN_0xC0A2", "kex": "other"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x006A", "name": "UNKNOWN_0x006A", "kex": "other"}, {"id": "0xC073", "name": "UNKNOWN_0xC073", "kex": "other"}, {"id": "0xC077", "name": "UNKNOWN_0xC077", "kex": "other"}, {"id": "0x00C4", "name": "UNKNOWN_0x00C4", "kex": "other"}, {"id": "0x00C3", "name": "UNKNOWN_0x00C3", "kex": "other"}, {"id": "0x006D", "name": "UNKNOWN_0x006D", "kex": "other"}, {"id": "0x00C5", "name": "UNKNOWN_0x00C5", "kex": "other"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0040", "name": "UNKNOWN_0x0040", "kex": "other"}, {"id": "0xC072", "name": "UNKNOWN_0xC072", "kex": "other"}, {"id": "0xC076", "name": "UNKNOWN_0xC076", "kex": "other"}, {"id": "0x00BE", "name": "UNKNOWN_0x00BE", "kex": "other"}, {"id": "0x00BD", "name": "UNKNOWN_0x00BD", "kex": "other"}, {"id": "0x006C", "name": "UNKNOWN_0x006C", "kex": "other"}, {"id": "0x00BF", "name": "UNKNOWN_0x00BF", "kex": "other"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0038", "name": "UNKNOWN_0x0038", "kex": "other"}, {"id": "0x0088", "name": "UNKNOWN_0x0088", "kex": "other"}, {"id": "0x0087", "name": "UNKNOWN_0x0087", "kex": "other"}, {"id": "0xC019", "name": "UNKNOWN_0xC019", "kex": "other"}, {"id": "0x003A", "name": "UNKNOWN_0x003A", "kex": "other"}, {"id": "0x0089", "name": "UNKNOWN_0x0089", "kex": "other"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0032", "name": "UNKNOWN_0x0032", "kex": "other"}, {"id": "0x0045", "name": "UNKNOWN_0x0045", "kex": "other"}, {"id": "0x0044", "name": "UNKNOWN_0x0044", "kex": "other"}, {"id": "0xC018", "name": "UNKNOWN_0xC018", "kex": "other"}, {"id": "0x0034", "name": "UNKNOWN_0x0034", "kex": "other"}, {"id": "0x0046", "name": "UNKNOWN_0x0046", "kex": "other"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0xC09D", "name": "UNKNOWN_0xC09D", "kex": "other"}, {"id": "0xC051", "name": "UNKNOWN_0xC051", "kex": "other"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0xC09C", "name": "UNKNOWN_0xC09C", "kex": "other"}, {"id": "0xC050", "name": "UNKNOWN_0xC050", "kex": "other"}, {"id": "0xC0A1", "name": "UNKNOWN_0xC0A1", "kex": "other"}, {"id": "0xC0A0", "name": "UNKNOWN_0xC0A0", "kex": "other"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x00C0", "name": "UNKNOWN_0x00C0", "kex": "other"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x00BA", "name": "UNKNOWN_0x00BA", "kex": "other"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x0084", "name": "UNKNOWN_0x0084", "kex": "other"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0041", "name": "UNKNOWN_0x0041", "kex": "other"}], "n_ciphers": 86, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "ecdsa_sha1", "0x301", "rsa_pkcs1_sha1", "0x302", "0x202", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-ecdsa", "profile_title": "Let's Encrypt, ECDSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "ECDSA (secp256r1)", "key_usage": ["digitalSignature"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "This ARC's certificate has an ECDSA key, but the ARC only knows RSA key transport, which needs an RSA key. It cannot use its own certificate, so every client fails.", "ms": 3}, {"ts": 1791789486.1131897, "time": "2026-10-12T07:18:06.113+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53064", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "GET /api/hello HTTP/1.1", "response": "200 OK (540 bytes)", "ms": 5}, {"ts": 1791789486.1126122, "time": "2026-10-12T07:18:06.112+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41748", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-custom tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "app_note": "client closed the connection after the handshake without finishing the exchange (BrokenPipeError: [Errno 32] Broken pipe)", "ms": 6}, {"ts": 1791789486.2224822, "time": "2026-10-12T07:18:06.222+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53082", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "GET /api/hello HTTP/1.1", "response": "200 OK (540 bytes)", "ms": 5}, {"ts": 1791789486.222206, "time": "2026-10-12T07:18:06.222+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41762", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-custom tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "ms": 6}, {"ts": 1791789488.1978264, "time": "2026-10-12T07:18:08.197+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53098", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 15, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "sigalgs": ["0x7a7a", "0x904", "0x905", "0x906", "ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512"], "alpn": ["h2", "http/1.1"], "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "GET / HTTP/1.1", "response": "200 OK (531 bytes)", "ms": 6}, {"ts": 1791789488.379685, "time": "2026-10-12T07:18:08.379+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53118", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 15, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"], "sigalgs": ["0x5a5a", "0x904", "0x905", "0x906", "ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512"], "alpn": ["h2", "http/1.1"], "sni": "arclab-arc-custom-b2rc4.sprites.app"}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The client closed the connection after receiving the certificate, without sending an alert.", "ms": 1370}, {"ts": 1791789489.7560468, "time": "2026-10-12T07:18:09.756+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53138", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 15, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"], "sigalgs": ["0x4a4a", "0x904", "0x905", "0x906", "ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "alpn": ["h2", "http/1.1"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "GET / HTTP/1.1", "response": "200 OK (531 bytes)", "ms": 5}, {"ts": 1791789489.932257, "time": "2026-10-12T07:18:09.932+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53160", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 15, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "alpn": ["h2", "http/1.1"], "sigalgs": ["0x7a7a", "0x904", "0x905", "0x906", "ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The client closed the connection after receiving the certificate, without sending an alert.", "ms": 502}, {"ts": 1791789490.8552752, "time": "2026-10-12T07:18:10.855+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53164", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}], "n_ciphers": 30, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "alpn": ["h2", "http/1.1"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "GET /api/hello HTTP/1.1", "response": "200 OK (540 bytes)", "ms": 9}, {"ts": 1791789490.8793464, "time": "2026-10-12T07:18:10.879+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53188", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 13, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 8}, {"ts": 1791789490.8797526, "time": "2026-10-12T07:18:10.879+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41776", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}], "n_ciphers": 30, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-custom tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "ms": 15}, {"ts": 1791789490.9023736, "time": "2026-10-12T07:18:10.902+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53204", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}], "n_ciphers": 17, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 7}, {"ts": 1791789490.9456987, "time": "2026-10-12T07:18:10.945+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53224", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}], "n_ciphers": 30, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "", "response": "200 OK (531 bytes)", "ms": 11}, {"ts": 1791789490.9683359, "time": "2026-10-12T07:18:10.968+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41790", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 13, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 2}, {"ts": 1791789490.9697037, "time": "2026-10-12T07:18:10.969+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41802", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}], "n_ciphers": 17, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 2}, {"ts": 1791789490.996807, "time": "2026-10-12T07:18:10.996+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53246", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "", "response": "200 OK (531 bytes)", "ms": 12}, {"ts": 1791789491.0695968, "time": "2026-10-12T07:18:11.069+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:53266", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x00A3", "name": "UNKNOWN_0x00A3", "kex": "other"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC0AD", "name": "UNKNOWN_0xC0AD", "kex": "other"}, {"id": "0xC09F", "name": "UNKNOWN_0xC09F", "kex": "other"}, {"id": "0xC05D", "name": "UNKNOWN_0xC05D", "kex": "other"}, {"id": "0xC061", "name": "UNKNOWN_0xC061", "kex": "other"}, {"id": "0xC057", "name": "UNKNOWN_0xC057", "kex": "other"}, {"id": "0xC053", "name": "UNKNOWN_0xC053", "kex": "other"}, {"id": "0x00A7", "name": "UNKNOWN_0x00A7", "kex": "other"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x00A2", "name": "UNKNOWN_0x00A2", "kex": "other"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC0AC", "name": "UNKNOWN_0xC0AC", "kex": "other"}, {"id": "0xC09E", "name": "UNKNOWN_0xC09E", "kex": "other"}, {"id": "0xC05C", "name": "UNKNOWN_0xC05C", "kex": "other"}, {"id": "0xC060", "name": "UNKNOWN_0xC060", "kex": "other"}, {"id": "0xC056", "name": "UNKNOWN_0xC056", "kex": "other"}, {"id": "0xC052", "name": "UNKNOWN_0xC052", "kex": "other"}, {"id": "0x00A6", "name": "UNKNOWN_0x00A6", "kex": "other"}, {"id": "0xC0AF", "name": "UNKNOWN_0xC0AF", "kex": "other"}, {"id": "0xC0AE", "name": "UNKNOWN_0xC0AE", "kex": "other"}, {"id": "0xC0A3", "name": "UNKNOWN_0xC0A3", "kex": "other"}, {"id": "0xC0A2", "name": "UNKNOWN_0xC0A2", "kex": "other"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x006A", "name": "UNKNOWN_0x006A", "kex": "other"}, {"id": "0xC073", "name": "UNKNOWN_0xC073", "kex": "other"}, {"id": "0xC077", "name": "UNKNOWN_0xC077", "kex": "other"}, {"id": "0x00C4", "name": "UNKNOWN_0x00C4", "kex": "other"}, {"id": "0x00C3", "name": "UNKNOWN_0x00C3", "kex": "other"}, {"id": "0x006D", "name": "UNKNOWN_0x006D", "kex": "other"}, {"id": "0x00C5", "name": "UNKNOWN_0x00C5", "kex": "other"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0040", "name": "UNKNOWN_0x0040", "kex": "other"}, {"id": "0xC072", "name": "UNKNOWN_0xC072", "kex": "other"}, {"id": "0xC076", "name": "UNKNOWN_0xC076", "kex": "other"}, {"id": "0x00BE", "name": "UNKNOWN_0x00BE", "kex": "other"}, {"id": "0x00BD", "name": "UNKNOWN_0x00BD", "kex": "other"}, {"id": "0x006C", "name": "UNKNOWN_0x006C", "kex": "other"}, {"id": "0x00BF", "name": "UNKNOWN_0x00BF", "kex": "other"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0038", "name": "UNKNOWN_0x0038", "kex": "other"}, {"id": "0x0088", "name": "UNKNOWN_0x0088", "kex": "other"}, {"id": "0x0087", "name": "UNKNOWN_0x0087", "kex": "other"}, {"id": "0xC019", "name": "UNKNOWN_0xC019", "kex": "other"}, {"id": "0x003A", "name": "UNKNOWN_0x003A", "kex": "other"}, {"id": "0x0089", "name": "UNKNOWN_0x0089", "kex": "other"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0032", "name": "UNKNOWN_0x0032", "kex": "other"}, {"id": "0x0045", "name": "UNKNOWN_0x0045", "kex": "other"}, {"id": "0x0044", "name": "UNKNOWN_0x0044", "kex": "other"}, {"id": "0xC018", "name": "UNKNOWN_0xC018", "kex": "other"}, {"id": "0x0034", "name": "UNKNOWN_0x0034", "kex": "other"}, {"id": "0x0046", "name": "UNKNOWN_0x0046", "kex": "other"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0xC09D", "name": "UNKNOWN_0xC09D", "kex": "other"}, {"id": "0xC051", "name": "UNKNOWN_0xC051", "kex": "other"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0xC09C", "name": "UNKNOWN_0xC09C", "kex": "other"}, {"id": "0xC050", "name": "UNKNOWN_0xC050", "kex": "other"}, {"id": "0xC0A1", "name": "UNKNOWN_0xC0A1", "kex": "other"}, {"id": "0xC0A0", "name": "UNKNOWN_0xC0A0", "kex": "other"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x00C0", "name": "UNKNOWN_0x00C0", "kex": "other"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x00BA", "name": "UNKNOWN_0x00BA", "kex": "other"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x0084", "name": "UNKNOWN_0x0084", "kex": "other"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0041", "name": "UNKNOWN_0x0041", "kex": "other"}], "n_ciphers": 86, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "ecdsa_sha1", "0x301", "rsa_pkcs1_sha1", "0x302", "0x202", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "", "app_note": "client closed the connection after the handshake without finishing the exchange (EOF occurred in violation of protocol (_ssl.c:2500))", "ms": 11}, {"ts": 1791789491.0766969, "time": "2026-10-12T07:18:11.076+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41820", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-custom tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "ms": 10}, {"ts": 1791789491.1392374, "time": "2026-10-12T07:18:11.139+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:41832", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x00A3", "name": "UNKNOWN_0x00A3", "kex": "other"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC0AD", "name": "UNKNOWN_0xC0AD", "kex": "other"}, {"id": "0xC09F", "name": "UNKNOWN_0xC09F", "kex": "other"}, {"id": "0xC05D", "name": "UNKNOWN_0xC05D", "kex": "other"}, {"id": "0xC061", "name": "UNKNOWN_0xC061", "kex": "other"}, {"id": "0xC057", "name": "UNKNOWN_0xC057", "kex": "other"}, {"id": "0xC053", "name": "UNKNOWN_0xC053", "kex": "other"}, {"id": "0x00A7", "name": "UNKNOWN_0x00A7", "kex": "other"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x00A2", "name": "UNKNOWN_0x00A2", "kex": "other"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC0AC", "name": "UNKNOWN_0xC0AC", "kex": "other"}, {"id": "0xC09E", "name": "UNKNOWN_0xC09E", "kex": "other"}, {"id": "0xC05C", "name": "UNKNOWN_0xC05C", "kex": "other"}, {"id": "0xC060", "name": "UNKNOWN_0xC060", "kex": "other"}, {"id": "0xC056", "name": "UNKNOWN_0xC056", "kex": "other"}, {"id": "0xC052", "name": "UNKNOWN_0xC052", "kex": "other"}, {"id": "0x00A6", "name": "UNKNOWN_0x00A6", "kex": "other"}, {"id": "0xC0AF", "name": "UNKNOWN_0xC0AF", "kex": "other"}, {"id": "0xC0AE", "name": "UNKNOWN_0xC0AE", "kex": "other"}, {"id": "0xC0A3", "name": "UNKNOWN_0xC0A3", "kex": "other"}, {"id": "0xC0A2", "name": "UNKNOWN_0xC0A2", "kex": "other"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x006A", "name": "UNKNOWN_0x006A", "kex": "other"}, {"id": "0xC073", "name": "UNKNOWN_0xC073", "kex": "other"}, {"id": "0xC077", "name": "UNKNOWN_0xC077", "kex": "other"}, {"id": "0x00C4", "name": "UNKNOWN_0x00C4", "kex": "other"}, {"id": "0x00C3", "name": "UNKNOWN_0x00C3", "kex": "other"}, {"id": "0x006D", "name": "UNKNOWN_0x006D", "kex": "other"}, {"id": "0x00C5", "name": "UNKNOWN_0x00C5", "kex": "other"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0040", "name": "UNKNOWN_0x0040", "kex": "other"}, {"id": "0xC072", "name": "UNKNOWN_0xC072", "kex": "other"}, {"id": "0xC076", "name": "UNKNOWN_0xC076", "kex": "other"}, {"id": "0x00BE", "name": "UNKNOWN_0x00BE", "kex": "other"}, {"id": "0x00BD", "name": "UNKNOWN_0x00BD", "kex": "other"}, {"id": "0x006C", "name": "UNKNOWN_0x006C", "kex": "other"}, {"id": "0x00BF", "name": "UNKNOWN_0x00BF", "kex": "other"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0038", "name": "UNKNOWN_0x0038", "kex": "other"}, {"id": "0x0088", "name": "UNKNOWN_0x0088", "kex": "other"}, {"id": "0x0087", "name": "UNKNOWN_0x0087", "kex": "other"}, {"id": "0xC019", "name": "UNKNOWN_0xC019", "kex": "other"}, {"id": "0x003A", "name": "UNKNOWN_0x003A", "kex": "other"}, {"id": "0x0089", "name": "UNKNOWN_0x0089", "kex": "other"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0032", "name": "UNKNOWN_0x0032", "kex": "other"}, {"id": "0x0045", "name": "UNKNOWN_0x0045", "kex": "other"}, {"id": "0x0044", "name": "UNKNOWN_0x0044", "kex": "other"}, {"id": "0xC018", "name": "UNKNOWN_0xC018", "kex": "other"}, {"id": "0x0034", "name": "UNKNOWN_0x0034", "kex": "other"}, {"id": "0x0046", "name": "UNKNOWN_0x0046", "kex": "other"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0xC09D", "name": "UNKNOWN_0xC09D", "kex": "other"}, {"id": "0xC051", "name": "UNKNOWN_0xC051", "kex": "other"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0xC09C", "name": "UNKNOWN_0xC09C", "kex": "other"}, {"id": "0xC050", "name": "UNKNOWN_0xC050", "kex": "other"}, {"id": "0xC0A1", "name": "UNKNOWN_0xC0A1", "kex": "other"}, {"id": "0xC0A0", "name": "UNKNOWN_0xC0A0", "kex": "other"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x00C0", "name": "UNKNOWN_0x00C0", "kex": "other"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x00BA", "name": "UNKNOWN_0x00BA", "kex": "other"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x0084", "name": "UNKNOWN_0x0084", "kex": "other"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0041", "name": "UNKNOWN_0x0041", "kex": "other"}], "n_ciphers": 86, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-custom-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "ecdsa_sha1", "0x301", "rsa_pkcs1_sha1", "0x302", "0x202", "0x402", "0x502", "0x602"]}, "server": {"profile": "le-rsa", "profile_title": "Let's Encrypt, RSA key (real, publicly trusted)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "arclab-arc-custom-b2rc4.sprites.app", "key_type": "RSA", "key_usage": ["digitalSignature", "keyEncipherment"], "may_encrypt_secret": true, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-custom tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "app_note": "client closed the connection after the handshake without finishing the exchange (BrokenPipeError: [Errno 32] Broken pipe)", "ms": 10}], "now": 1791790810.8741062}