=            key |  Label text
=----------------+------------------------------------------------------------
           beast - Connection is safe against BEAST attack (any cipher)
          breach - Connection is safe against BREACH attack
             ccs - Connection is safe against CCS Injection attack
        certfqdn - Certificate is valid according given hostname
      cipher_adh - Target does not accept ADH ciphers
      cipher_cbc - Target does not accept CBC ciphers
      cipher_des - Target does not accept DES ciphers
      cipher_edh - Target supports EDH ciphers
      cipher_exp - Target does not accept EXPORT ciphers
     cipher_null - Target does not accept NULL ciphers
    cipher_order - Target does not honors client's cipher order
      cipher_pfs - Target supports PFS (selected cipher)
   cipher_pfsall - Target supports PFS (all ciphers)
      cipher_rc4 - Target does not accept RC4 ciphers
   cipher_strong - Target selects strongest cipher
     cipher_weak - Target does not accept weak cipher
         closure - Target understands TLS closure alerts
     cnt_altname - Certificate Subject Altname count
  cnt_chaindepth - Certificate Chain Depth count
   cnt_checks_no - Total number of check results 'no'
  cnt_checks_noo - Total number of check results 'no(<<)'
  cnt_checks_yes - Total number of check results 'yes'
     cnt_ciphers - Total number of checked ciphers
    cnt_exitcode - Total number of insecure checks
      cnt_totals - Total number of accepted ciphers
    cnt_wildcard - Certificate Wildcards count
     compression - Target does not support Compression
     constraints - Certificate Basic Constraints is false
             cps - Certificate has Certification Practice Statement
       cps_valid - Certificate has valid CPS URL
           crime - Connection is safe against CRIME attack
             crl - Certificate has CRL Distribution Points
       crl_valid - Certificate has valid CRL URL
        crnlnull - Certificate does not contain CR, NL, NULL characters
           dates - Certificate is valid
         dh_2048 - Target DH Parameter >= 2048 bits
          dh_512 - Target DH Parameter >= 512 bits
           drown - Connection is safe against DROWN attack
              dv - Certificate Domain Validation (DV)
        ecdh_256 - Target DH Parameter >= 256 bits (ECDH)
        ecdh_512 - Target DH Parameter >= 512 bits (ECDH)
             ev+ - Certificate strict Extended Validation (EV)
             ev- - Certificate lazy Extended Validation (EV)
        ev_chars - Certificate has no invalid characters in extensions
         expired - Certificate is not expired
        fallback - Target supports fallback from TLSv1.1
            fips - Target is FIPS-140 compliant
      fp_not_md5 - Certificate Fingerprint is not MD5
           freak - Connection is safe against FREAK attack
         hasalpn - Target supports ALPN
        hasdtls1 - Target supports DTLSv1
       hasdtls12 - Target supports DTLSv1.2
       hasdtls13 - Target supports DTLSv1.3
          hasnpn - Target supports  NPN
        hassslv2 - Target does not support SSLv2
        hassslv3 - Target does not support SSLv3
        hastls10 - Target does not supports TLSv1
    hastls10_old - Target supports TLSv1
        hastls11 - Target does not supports TLSv1.1
    hastls11_old - Target supports TLSv1.1
        hastls12 - Target supports TLSv1.2
        hastls13 - Target supports TLSv1.3
       heartbeat - Target does not support heartbeat extension
      heartbleed - Connection is safe against Heartbleed attack
        hostname - Connected hostname equals certificate's Subject
       hsts_fqdn - Target redirect matches given host
  hsts_httpequiv - Target does not send STS in meta tag
         hsts_ip - Target does not send STS header for IP
      hsts_is301 - Target redirects with status code 301
      hsts_is30x - Target redirects not with 30x status code
   hsts_location - Target sends STS and no Location header
   hsts_redirect - Target redirects HTTP without STS header
    hsts_refresh - Target sends STS and no Refresh header
   hsts_samehost - Target redirects HTTP to HTTPS same host
        hsts_sts - Target sends STS header
      http_https - Target redirects HTTP to HTTPS
      https_pins - Target sends Public-Key-Pins header
             ism - Target is ISM compliant (ciphers only)
            krb5 - Target supports Krb5
     len_altname - Certificate Subject Altname size
       len_chain - Certificate Chain size
         len_cps - Certificate CPS size
         len_crl - Certificate CRL size
    len_crl_data - Certificate CRL data size
      len_issuer - Certificate Issuer size
        len_ocsp - Certificate OCSP size
        len_oids - Certificate OIDs size
   len_pembase64 - Certificate PEM (base64) size
   len_pembinary - Certificate PEM (binary) size
   len_publickey - Certificate Public Key size
   len_sernumber - Certificate Serial Number size
     len_sigdump - Certificate Signature Key size
     len_subject - Certificate Subject size
          logjam - Connection is safe against Logjam attack
         lucky13 - Connection is safe against Lucky 13 attack
             lzo - Certificate has (GnuTLS extension) compression
   master_secret - Target supports Extended Master Secret
   modulus_exp_1 - Certificate Public Key Modulus Exponent <>1
modulus_exp_65537 - Certificate Public Key Modulus Exponent =65537
modulus_exp_oldssl - Certificate Public Key Modulus Exponent >65537
modulus_size_oldssl - Certificate Public Key Modulus >16385 bits
        nonprint - Certificate does not contain non-printable characters
   ocsp_stapling - Target supports OCSP Stapling
        ocsp_uri - Certificate has OCSP Responder URL
      ocsp_valid - Certificate has valid OCSP URL
        open_pgp - Certificate has (TLS extension) authentication
             pci - Target is PCI compliant (ciphers only)
          poodle - Connection is safe against POODLE attack
        psk_hint - Target supports PSK Identity Hint
    psk_identity - Target supports PSK
   pub_enc_known - Certificate Public Key Encryption known
  pub_encryption - Certificate Public Key with Encryption
             rc4 - Connection is safe against RC4 attack
   renegotiation - Target supports Secure Renegotiation
      resumption - Target supports Resumption
     reversehost - Given hostname is same as reverse resolved hostname
  rfc_2818_names - Certificate subjectAltNames compliant to RFC 2818
  rfc_6125_names - Certificate Names compliant to RFC 6125
        rfc_7525 - Target is RFC 7525 compliant
           robot - Connection is safe against ROBOT attack
        rootcert - Certificate is not root CA
            scsv - Target does not support SCSV
      selfsigned - Certificate is not self-signed
       sernumber - Certificate Serial Number size RFC 5280
session_lifetime - Target TLS Session Ticket Lifetime
  session_random - Target TLS Session Ticket is random
session_starttime - Target TLS Session Start Time match
  session_ticket - Target supports TLS Session Ticket
             sgc - Target supports Server Gated Cryptography (SGC)
   sha2signature - Certificate Private Key Signature SHA2
   sig_enc_known - Certificate Private Key Encryption known
  sig_encryption - Certificate Private Key with Encryption
           sloth - Connection is safe against SLOTH attack
             sni - Connection is not based on SNI
             srp - Target supports SRP
            sstp - Target does not support method SSTP
     sts_expired - STS max-age < certificate's validity
      sts_maxage - Target sends STS header with proper max-age
    sts_maxage0d - STS max-age not reset
    sts_maxage18 - STS max-age more than 18 weeks
    sts_maxage1d - STS max-age less than one day
    sts_maxage1m - STS max-age less than one month
    sts_maxage1y - STS max-age less than one year
    sts_maxagexy - STS max-age more than one year
     sts_preload - Target sends STS header with preload
      sts_subdom - Target sends STS header with includeSubdomain
         sweet32 - Connection is safe against Sweet32 attack
            time - Connection is safe against TIME attack
       tr_02102+ - Target is strict TR-02102-2 compliant
       tr_02102- - Target is  lazy  TR-02102-2 compliant
       tr_03116+ - Target is strict TR-03116-4 compliant
       tr_03116- - Target is  lazy  TR-03116-4 compliant
          verify - Certificate chain validated
        wildcard - Certificate does not contain wildcards
        wildhost - Certificate's wildcard does not match hostname
            zlib - Certificate has (TLS extension) compression
=----------------+------------------------------------------------------------
