{"offline_self_check": "TLS13 API availability and digest known vector only"}
{"environment": "macOS-27.0-arm64-arm-64bit-Mach-O", "python": "3.14.4", "python_ssl": "OpenSSL 3.6.2 7 Apr 2026", "SSLKEYLOGFILE_removed_if_present": false}
{"openssl_command": ["version"], "stdout": "OpenSSL 3.6.2 7 Apr 2026 (Library: OpenSSL 3.6.2 7 Apr 2026)\n", "stderr": ""}
{"openssl_command": ["req", "-x509", "-newkey", "rsa:2048", "-noenc", "-days", "1", "-keyout", "root.key", "-out", "root.pem", "-subj", "/CN=TLS Lab root", "-addext", "basicConstraints=critical,CA:TRUE,pathlen:0", "-addext", "keyUsage=critical,keyCertSign,cRLSign", "-addext", "subjectKeyIdentifier=hash"], "stdout": "", "stderr": "..+.+..............+.+...........+...+......+.+.....+++++++++++++++++++++++++++++++++++++++*...+....+.....+++++++++++++++++++++++++++++++++++++++*...+....+..+...+......+.......+........+.+..............+.+.....+.++++++\n...+...+.....+.........+++++++++++++++++++++++++++++++++++++++*..+.....+.........+.+..+...+.........+.......+...+++++++++++++++++++++++++++++++++++++++*......+........++++++\n-----\n"}
{"openssl_command": ["req", "-x509", "-newkey", "rsa:2048", "-noenc", "-days", "1", "-keyout", "other.key", "-out", "other.pem", "-subj", "/CN=TLS Lab other", "-addext", "basicConstraints=critical,CA:TRUE,pathlen:0", "-addext", "keyUsage=critical,keyCertSign,cRLSign", "-addext", "subjectKeyIdentifier=hash"], "stdout": "", "stderr": ".....+..+...+.+++++++++++++++++++++++++++++++++++++++*......+...+..............+++++++++++++++++++++++++++++++++++++++*.............+....++++++\n........+.+++++++++++++++++++++++++++++++++++++++*......+......+...+.......+...+++++++++++++++++++++++++++++++++++++++*..+...+....+..+.+.........+........+.+.........+.....+...+....+...+..+......+.........+.............+......+.....+.+........+...+............+.+......+......+...+.....+.........+...+..........+...+..............+.......+...+.....+.............+.........+...+..+....+.....+.......+..+.+..+...+......+...+................+..+.........++++++\n-----\n"}
{"openssl_command": ["req", "-new", "-newkey", "rsa:2048", "-noenc", "-keyout", "leaf.key", "-out", "leaf.csr", "-subj", "/CN=unused-common-name.lab.test"], "stdout": "", "stderr": ".....+...+..+......+...+++++++++++++++++++++++++++++++++++++++*.+++++++++++++++++++++++++++++++++++++++*...+.+.....+.+............+........+............+...+.......+..+................+..+.....................+.+......+.........+......+........+....+..+..................+.+.........+.....+...+...+.......+.................+...............+.+..+...+.+...+...+..+...+...+...............+....+............+...........+....+...+...+............+...+..+......+......+...+.......+......+.........+...........+.......+...+...+...........+......+...+....+........+...+......+.+.........+.........+.....+....+...+..+.......+.....................+..............+.........+.+........+...+....+.....+..........+......+..+.+..+....+.....+...+......+.......+...+...........+..................+.+..+.............+..+...+.+...+......+.....+......+.+.....+.......+.....+......+.+...........+..........+..+.+......+........+......+.........+......+.......+..............+.+..+......+.+......+........+.+...+..+.+...+...............+...........+...+...+.......+.....+.+...........+...+.......+......+............+.....+.......+...........+...+.........+.+......+.....+......+..........+..+.......+.....+.+..+............+.+...+..+...+.+......+.....+.......+.................+...+.+..+.........+......+............+.......+...+..+.........+.+.....+.+..+...+.........+......+...+....+.....................+..+...................+...+...+...+.........+..+...+............+.+...+..+...+......+...+...+....+.....+....+..+.........+...................+..+............+..........+...+........+.+..............+....+...........+............+...+.......+...+.........+........+....+......+.......................+.+.........+.................+...+.+...+........+.......+...+..............+....+........................+..+....+..............+.+......+......+.........+....................+..........+.....+...+......+...............+.+.....+...+......+.........+.+.....+....+..+.+..+...+.......+........+.......+..+...+..........+..+.........+....+...+.....+...+.+......+...+......+.....+......+....+...+..+......+.......+......+.................+.......+......+..+...+....+.....+.++++++\n...+...+++++++++++++++++++++++++++++++++++++++*......+...........+.+++++++++++++++++++++++++++++++++++++++*.+..+.........+.+.....+...+......+.........+..........+......+..+..........+...+..+.......+..+....+..+.........................+.........+...........+....+...+........+...+....+...............+...+..............+......++++++\n-----\n"}
{"openssl_command": ["x509", "-req", "-in", "leaf.csr", "-CA", "root.pem", "-CAkey", "root.key", "-set_serial", "24", "-days", "1", "-extfile", "leaf.ext", "-out", "leaf.pem"], "stdout": "", "stderr": "Certificate request self-signature ok\nsubject=CN=unused-common-name.lab.test\n"}
{"openssl_command": ["x509", "-in", "leaf.pem", "-noout", "-text", "-fingerprint", "-sha256"], "stdout": "Certificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 24 (0x18)\n        Signature Algorithm: sha256WithRSAEncryption\n        Issuer: CN=TLS Lab root\n        Validity\n            Not Before: Sep 20 07:29:13 2026 GMT\n            Not After : Sep 21 07:29:13 2026 GMT\n        Subject: CN=unused-common-name.lab.test\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:ae:36:27:f2:a0:44:d0:90:8b:00:fb:6f:73:90:\n                    65:1f:fb:d4:f8:85:a3:a0:b0:cc:95:23:01:a5:a0:\n                    49:90:1b:34:de:ab:63:50:4d:d9:d4:05:e1:b9:50:\n                    f7:b5:72:2c:67:cc:f6:96:20:d6:8d:35:85:0b:e6:\n                    62:1d:9f:4b:fa:57:8e:64:84:bf:98:af:ec:82:82:\n                    6f:37:6e:53:60:e7:57:85:5b:31:e7:9d:e4:1b:cb:\n                    55:b5:9a:df:76:a8:13:ff:39:1a:b8:80:78:d3:3a:\n                    a6:09:57:a3:e6:ea:b2:63:2d:9e:93:d3:6c:1d:c1:\n                    5a:a6:7f:35:76:52:b2:cc:f9:07:c4:52:e4:b3:d7:\n                    52:fa:d9:ff:b5:8f:08:54:51:6b:d7:f9:8d:32:f0:\n                    f4:27:8d:fa:1b:0b:83:55:95:e5:ed:ba:5c:dd:d8:\n                    38:3c:a4:a8:df:83:00:f7:58:0e:a6:56:4f:93:d7:\n                    ce:88:18:c5:95:04:34:3f:a1:e7:d8:ed:b3:68:2a:\n                    bf:8f:2a:00:06:ca:2b:01:48:77:17:a0:67:ad:ec:\n                    d0:14:7a:73:93:cc:d6:46:58:ff:ac:01:54:49:0e:\n                    ad:bd:2b:0f:0a:af:20:ff:5f:8b:db:3a:c7:9c:7c:\n                    e0:03:8a:10:9c:6f:71:d5:9d:b5:b8:bb:c6:62:87:\n                    2e:39\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:FALSE\n            X509v3 Key Usage: critical\n                Digital Signature\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication\n            X509v3 Subject Key Identifier: \n                74:EC:DF:36:99:7D:C1:18:AE:F4:6F:0A:1C:44:57:E7:39:19:31:68\n            X509v3 Authority Key Identifier: \n                87:37:50:77:AB:82:F5:63:11:D9:E7:DD:6D:E8:67:46:C0:1A:D0:BA\n            X509v3 Subject Alternative Name: \n                DNS:server.lab.test\n    Signature Algorithm: sha256WithRSAEncryption\n    Signature Value:\n        44:26:d9:7e:c2:39:d8:3b:0f:99:78:c8:03:bd:b8:4c:0a:06:\n        52:ff:d7:c8:cd:d9:e4:b7:22:bc:d1:a4:0d:d3:9d:a8:c9:d6:\n        ef:44:ea:fa:3f:19:db:a4:be:d5:2b:5b:f9:26:ef:14:15:20:\n        24:f5:95:86:1c:b8:db:04:d0:2c:22:c4:e3:e8:4c:f0:18:29:\n        32:f5:a9:e3:69:8f:1d:01:73:eb:2b:56:98:9c:4a:7d:98:48:\n        5b:8e:e0:31:5a:cf:d2:62:ed:60:00:2b:c9:5a:0c:87:50:64:\n        6d:b4:d5:66:61:87:13:b6:b2:bd:da:ae:8d:e1:23:db:07:14:\n        52:4a:04:b6:0e:27:8d:e0:5d:6b:29:35:bd:c7:83:7b:aa:52:\n        69:41:eb:ad:88:16:f6:53:65:ec:45:93:68:44:1b:00:7b:8e:\n        4a:67:13:16:4a:18:47:d9:e3:f2:cf:f9:37:62:d8:4e:35:58:\n        d9:38:79:df:bf:4c:1c:c1:86:48:77:7b:fe:1c:2b:46:10:19:\n        8d:ae:1c:b5:83:49:01:65:4f:7a:f6:cc:1f:72:49:b0:53:66:\n        da:8a:4a:ee:7b:39:1b:dc:cc:61:40:07:da:3f:14:01:6a:f6:\n        28:66:7c:be:06:a9:a3:62:b9:84:5f:2f:9b:ff:57:ab:c5:b4:\n        56:87:4a:12\nsha256 Fingerprint=BE:F8:85:15:CA:D7:FC:37:71:BA:3F:E3:66:C8:85:3A:E6:52:CD:50:3E:A0:C5:0E:42:F1:A0:E4:F6:AD:EC:65\n", "stderr": ""}
{"trusted_root": true, "server_hostname": "server.lab.test", "connection_address": ["127.0.0.1", 63774], "verify_flags": 557088, "check_hostname": true, "common_name_fallback": false, "trust_store_stats": {"x509": 1, "crl": 0, "x509_ca": 1}, "client": {"handshake": "success", "version": "TLSv1.3", "cipher": ["TLS_AES_256_GCM_SHA384", "TLSv1.3", 256], "peer_certificate": {"subject": [[["commonName", "unused-common-name.lab.test"]]], "issuer": [[["commonName", "TLS Lab root"]]], "version": 3, "serialNumber": "18", "notBefore": "Sep 20 07:29:13 2026 GMT", "notAfter": "Sep 21 07:29:13 2026 GMT", "subjectAltName": [["DNS", "server.lab.test"]]}, "peer_der_sha256": "bef88515cad7fc3771ba3fe366c8853ae652cd503ea0c50e42f1a0e4f6adec65", "challenge_hex": "ce99796be867d5354e65437b52f51f64ec7f11c6bc2e008a8b3442d725b1365e", "echo_hex": "ce99796be867d5354e65437b52f51f64ec7f11c6bc2e008a8b3442d725b1365e"}, "server": [{"handshake": "success", "peer": ["127.0.0.1", 63775], "version": "TLSv1.3", "cipher": ["TLS_AES_256_GCM_SHA384", "TLSv1.3", 256], "received_hex": "ce99796be867d5354e65437b52f51f64ec7f11c6bc2e008a8b3442d725b1365e", "echoed_hex": "ce99796be867d5354e65437b52f51f64ec7f11c6bc2e008a8b3442d725b1365e"}], "owned_thread_stopped": true}
{"trusted_root": true, "server_hostname": "wrong.lab.test", "connection_address": ["127.0.0.1", 63776], "verify_flags": 557088, "check_hostname": true, "common_name_fallback": false, "trust_store_stats": {"x509": 1, "crl": 0, "x509_ca": 1}, "client": {"handshake": "verification-failed", "verify_code": 62, "verify_message": "Hostname mismatch, certificate is not valid for 'wrong.lab.test'.", "application_bytes": 0}, "server": [{"handshake_or_io_error": "SSLError", "message": "[SSL: SSLV3_ALERT_BAD_CERTIFICATE] ssl/tls alert bad certificate (_ssl.c:1081)", "phase": "handshake", "application_exchange_started": false}], "owned_thread_stopped": true}
{"trusted_root": false, "server_hostname": "server.lab.test", "connection_address": ["127.0.0.1", 63778], "verify_flags": 557088, "check_hostname": true, "common_name_fallback": false, "trust_store_stats": {"x509": 1, "crl": 0, "x509_ca": 1}, "client": {"handshake": "verification-failed", "verify_code": 20, "verify_message": "unable to get local issuer certificate", "application_bytes": 0}, "server": [{"handshake_or_io_error": "SSLError", "message": "[SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:1081)", "phase": "handshake", "application_exchange_started": false}], "owned_thread_stopped": true}
{"temporary_keys_cleaned": true, "owned_listeners_closed": true}