{"offline_self_check": "summary allowlist excludes synthetic secret"}
{"openssl_command": ["version"], "stdout": "OpenSSL 3.6.2 7 Apr 2026 (Library: OpenSSL 3.6.2 7 Apr 2026)\n", "stderr": ""}
{"openssl_command": ["req", "-x509", "-newkey", "rsa:2048", "-noenc", "-days", "1", "-keyout", "root.key", "-out", "root.pem", "-subj", "/CN=TLS Lab root", "-addext", "basicConstraints=critical,CA:TRUE,pathlen:0", "-addext", "keyUsage=critical,keyCertSign,cRLSign", "-addext", "subjectKeyIdentifier=hash"], "stdout": "", "stderr": "....+.......+.....+.+.........+..+...+.......+...+........+++++++++++++++++++++++++++++++++++++++*.+...+......+...+..........+...+...............+..+.+..+....+...+........+...+....+.....+.......+...+...+...+.....+.+++++++++++++++++++++++++++++++++++++++*.+..+...+....+............+...+.....+.............+.....+....+.....+...+...+...+.+.........+.....+......+.+............+.....+..................+...+.++++++\n.+......+..+...+...+.+...+..+...+......+.......+...+......+...+...+..+......+++++++++++++++++++++++++++++++++++++++*.+............................+..+.............+.........+........+...+............+...+.+...+...+...+...........+++++++++++++++++++++++++++++++++++++++*...+.......+...+...+..+.+.....+......+..........+........+...+....+..............+....+..+......+...............+.............+.....+.......+..+.+..+............................+...........+.........+.+...+..+.............+...............+........+....+......+.....+.......+..+..........+......+...+..+...+....+...+..+......+.+......+........+.........+............+...+.+.....+..........+...........+................+..+..........+...+..+......+.+...+..+.+............+........+.........+......+.............+......+.....+...............+....+..+....+...+..+..........+...+........+..........+..+...+.......+........+...+............+............+............+.+.........+...+.....+...+.............+.....+.......+.........+...............++++++\n-----\n"}
{"openssl_command": ["req", "-x509", "-newkey", "rsa:2048", "-noenc", "-days", "1", "-keyout", "other.key", "-out", "other.pem", "-subj", "/CN=TLS Lab other", "-addext", "basicConstraints=critical,CA:TRUE,pathlen:0", "-addext", "keyUsage=critical,keyCertSign,cRLSign", "-addext", "subjectKeyIdentifier=hash"], "stdout": "", "stderr": ".+.....+.+..+++++++++++++++++++++++++++++++++++++++*...+++++++++++++++++++++++++++++++++++++++*...+.......+...+...+.....+...+................+...........+....+...+.....+..........+...........+.+.....+...+.....................+....+......+..+...+.......+.....+....+...............+........+............+...+............+......+.......+...+.........+...+......+...........+.+...+.........+...............+......+.....+....+...+...+.....+.+.....+.+.....+.......+...+..................+.....+......+...+............+...+...+....+...+........+...+....+...+..+.+......+.....+..........+..............+....+..+....+...........++++++\n..............+.+..+..........+......+..+++++++++++++++++++++++++++++++++++++++*...+........+...+....+...+...+........+.+...+........+++++++++++++++++++++++++++++++++++++++*...........+.........+...........+...+....+...+..+.............+...+.....+..........+..+.........+..........+.........+..............+.+......+.....+..................+...............+.+......+.....+.+..+..........+.....+...+...+.+........................+.........+..+...+..........+...........+.........+.+.....+............+.......+.....+..........+......+............+...+...........+...+...+.............+...........+...+......+.+..................+...+..+.............+...+.....+......+....+..+......................+.....+.+.....+...............+.+.....+....+..+....+.....+......+...+.+......+.....+...+....+...+...+..+.............+......+...+...............+...+..+......+.......+.....+...+.+...............+......+............+........+....+.........+......+...+........+....+.........+.....+......+...............+.+.....+.......+..+....+.........+..+....+.........+............+......+...+......+....................+...+.+.........+...+.....+.........+.........+.......+...+.....................+...+.................+.+..+......+......+...+......+.........+...+...+.......+..............+.+..+...+.........+...+.+..+...+.+......+..+.+..+..................+.......+...+......+...+...........+....++++++\n-----\n"}
{"openssl_command": ["req", "-new", "-newkey", "rsa:2048", "-noenc", "-keyout", "leaf.key", "-out", "leaf.csr", "-subj", "/CN=unused-common-name.lab.test"], "stdout": "", "stderr": "........+.+.........+...........+.......+...+...+..+...+++++++++++++++++++++++++++++++++++++++*...+.......+...+..+....+.....+.........+.......+..+.+.....+......+.+........+.......+.....+.......+...............+..+.............+..+.+..+.+..+++++++++++++++++++++++++++++++++++++++*.....+................+...+......+.....+.+...+...........+.+...+.....+.........+......+......+.+.....+..........+..+.+...............+......+...+...+..............+.+..+.......+.........+.....+.+......+..+.............+............+...+..+...+............+.+.....++++++\n...+.+..............+...+++++++++++++++++++++++++++++++++++++++*...+....+....................+.......+...+......+..+....+......+..+.......+......+..+...+...+.+...+..+...+++++++++++++++++++++++++++++++++++++++*........+..........+..+...+.+...+..+.+.....+...+..........+.........+..+....+...........................+..+.......+...+..+.+..+.+......++++++\n-----\n"}
{"openssl_command": ["x509", "-req", "-in", "leaf.csr", "-CA", "root.pem", "-CAkey", "root.key", "-set_serial", "24", "-days", "1", "-extfile", "leaf.ext", "-out", "leaf.pem"], "stdout": "", "stderr": "Certificate request self-signature ok\nsubject=CN=unused-common-name.lab.test\n"}
{"openssl_command": ["x509", "-in", "leaf.pem", "-noout", "-text", "-fingerprint", "-sha256"], "stdout": "Certificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 24 (0x18)\n        Signature Algorithm: sha256WithRSAEncryption\n        Issuer: CN=TLS Lab root\n        Validity\n            Not Before: Sep 20 09:51:01 2026 GMT\n            Not After : Sep 21 09:51:01 2026 GMT\n        Subject: CN=unused-common-name.lab.test\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:ca:5b:bc:de:97:9f:ad:d6:4b:4b:c7:d8:a3:51:\n                    e7:29:14:f9:1a:ea:45:6c:b1:24:07:8d:17:51:66:\n                    2c:c4:e8:fb:21:b3:b1:d5:26:9f:7a:15:24:b1:6d:\n                    6f:99:be:4e:df:f9:71:d2:4e:35:9e:26:d5:e7:5d:\n                    3c:4c:b3:93:40:6b:3f:98:ab:28:7d:71:15:bb:df:\n                    09:bc:2a:8f:ad:bb:71:21:67:f4:d6:b6:81:a3:44:\n                    5b:c3:a1:b1:fc:c6:05:28:9a:8d:68:a0:74:5d:c0:\n                    93:ea:5a:d5:f5:1f:7f:f7:07:98:7b:ea:f8:12:81:\n                    74:e6:db:c2:39:4e:6a:2f:4d:56:3b:42:49:b4:bb:\n                    33:8a:73:e2:06:d7:be:b3:53:88:27:c8:30:51:aa:\n                    38:06:6c:8e:dc:22:bc:24:ef:bf:93:d9:ce:fa:db:\n                    a6:eb:6a:29:4a:0b:3f:eb:36:a6:3c:bc:41:6b:19:\n                    ee:4e:a1:68:e8:e4:f6:17:ad:80:92:6f:58:b0:24:\n                    8d:d0:ec:9c:4e:58:1b:f1:1c:7d:d9:9c:00:a5:2c:\n                    b2:b0:ec:ef:b9:7a:f9:b9:19:30:d0:a4:31:8c:7e:\n                    45:d6:94:60:d6:30:cc:42:34:ef:56:35:46:b9:94:\n                    d4:84:c0:87:67:fe:0e:d6:08:7e:6b:07:39:9e:5d:\n                    a2:47\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Basic Constraints: critical\n                CA:FALSE\n            X509v3 Key Usage: critical\n                Digital Signature\n            X509v3 Extended Key Usage: \n                TLS Web Server Authentication\n            X509v3 Subject Key Identifier: \n                BF:1A:AF:00:D8:6B:5F:B0:79:39:9B:03:DC:D4:B3:4E:43:BF:A2:39\n            X509v3 Authority Key Identifier: \n                46:6F:CE:81:59:FB:C4:CA:F3:E6:58:D9:4A:D8:55:82:B8:6F:96:88\n            X509v3 Subject Alternative Name: \n                DNS:server.lab.test\n    Signature Algorithm: sha256WithRSAEncryption\n    Signature Value:\n        95:87:10:0e:0a:3f:5e:9a:39:9b:b4:99:75:81:f7:72:b2:ba:\n        c3:c8:61:f6:8b:bf:2a:a4:c4:0f:1f:ef:4e:9c:7b:81:54:d1:\n        80:1c:40:33:60:ac:ff:fa:9d:71:67:7c:72:39:00:4e:54:dd:\n        6c:39:fb:8b:9c:c1:3a:05:a7:31:2f:87:aa:e1:2c:a6:5e:13:\n        75:ed:c8:94:d9:37:dc:20:df:8e:ad:11:47:ab:b4:1d:4e:56:\n        30:cc:aa:8a:b0:eb:ca:52:22:f6:24:4d:74:29:dd:ef:a2:84:\n        61:e2:92:6c:76:b0:ac:7d:c1:db:31:70:3a:00:86:10:25:79:\n        dd:72:0c:35:b0:11:3f:67:98:fd:89:ac:60:18:41:9e:85:c6:\n        e7:4f:38:37:20:3a:da:02:c0:1e:6e:54:2e:79:6a:c4:7c:24:\n        8b:7b:75:3e:21:87:d7:ff:51:8b:6d:0a:f5:97:f3:09:04:14:\n        97:43:81:75:01:ae:12:a9:15:00:d3:d6:5e:54:1b:72:40:86:\n        55:0c:a5:ff:fd:2f:25:ac:10:93:3e:56:64:7d:32:60:e9:d6:\n        e3:b2:01:4c:24:13:12:f4:39:60:c2:34:fc:a9:c8:f4:a9:3b:\n        21:9c:e9:f7:44:75:22:c3:ec:8b:53:34:fe:55:31:97:33:4e:\n        e8:3e:2e:24\nsha256 Fingerprint=5B:2C:B3:3F:06:F0:2A:DA:93:E8:9D:85:E1:45:20:07:AD:F6:C4:08:05:FE:05:4B:C3:97:D5:F6:49:46:48:97\n", "stderr": ""}
{"environment": "macOS-27.0-arm64-arm-64bit-Mach-O", "server_command": ["/opt/homebrew/bin/openssl", "s_server", "-accept", "127.0.0.1:53297", "-cert", "leaf.pem", "-key", "leaf.key", "-tls1_3", "-early_data", "-max_early_data", "1024", "-recv_max_early_data", "1024", "-anti_replay", "-num_tickets", "2", "-naccept", "3"], "anti_replay": "explicit -anti_replay; never disabled", "secret_logs": "temporary only; published summaries allowlisted"}
{"connection_index": 0, "client_command": ["/opt/homebrew/bin/openssl", "s_client", "-connect", "127.0.0.1:53297", "-servername", "server.lab.test", "-verify_hostname", "server.lab.test", "-verify_return_error", "-CAfile", "root.pem", "-no-CApath", "-no-CAstore", "-tls1_3", "-no_ign_eof", "-sess_out", "session0.pem"], "summary": ["Verification: OK", "Verified peername: server.lab.test", "New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384", "Early data was not sent", "Verify return code: 0 (ok)", "Verify return code: 0 (ok)", "Verify return code: 0 (ok)"], "ticket_file_created": true, "client_exit_after_stdin_eof": 0}
{"connection_index": 1, "client_command": ["/opt/homebrew/bin/openssl", "s_client", "-connect", "127.0.0.1:53297", "-servername", "server.lab.test", "-verify_hostname", "server.lab.test", "-verify_return_error", "-CAfile", "root.pem", "-no-CApath", "-no-CAstore", "-tls1_3", "-no_ign_eof", "-sess_out", "session1.pem", "-sess_in", "session0.pem"], "summary": ["Verification: OK", "Reused, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384", "Early data was not sent", "Verify return code: 0 (ok)", "Verify return code: 0 (ok)"], "ticket_file_created": true, "client_exit_after_stdin_eof": 0}
{"connection_index": 2, "client_command": ["/opt/homebrew/bin/openssl", "s_client", "-connect", "127.0.0.1:53297", "-servername", "server.lab.test", "-verify_hostname", "server.lab.test", "-verify_return_error", "-CAfile", "root.pem", "-no-CApath", "-no-CAstore", "-tls1_3", "-no_ign_eof", "-sess_out", "session2.pem", "-sess_in", "session1.pem", "-early_data", "early.txt"], "summary": ["Verification: OK", "Reused, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384", "Early data was accepted", "Verify return code: 0 (ok)", "Verify return code: 0 (ok)"], "ticket_file_created": true, "client_exit_after_stdin_eof": 0}
{"server_summary": ["No early data received", "No early data received", "LAB25-EARLY-SAFE", "Early data received:", "End of early data"], "server_exit": 0, "early_text_observed": true}
{"temporary_secrets_cleaned": true, "owned_processes_stopped": true}