generated: '2026-08-12'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml hosts (probe-domain-security.py, then
  corrected by hand with openssl s_client + curl -I where the automated TLS probe
  failed on chain resolution)
hosts:
- host: elephas.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 28 10:08:57 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: portal.elephas.com
  https: true
  tls_version: TLSv1.3
  cert_issuer: Sectigo Public Server Authentication CA DV R36
  cert_expires: Dec 17 23:59:59 2026 GMT
  chain_complete: false
  chain_note: 'openssl s_client verify return code 21 (unable to verify the first
    certificate) — the server presents the leaf without its Sectigo intermediate.
    Browsers and curl recover via AIA fetching, but strict clients (Python ssl with
    the system store, some JVM and Go clients, many API gateways) fail the
    handshake. This is a real, fixable server misconfiguration, not a probe artifact.'
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: portal.elephasapis.com
  https: true
  tls_version: TLSv1.3
  cert_issuer: Sectigo Public Server Authentication CA DV R36
  cert_expires: Jan 16 23:59:59 2027 GMT
  chain_complete: false
  chain_note: Same incomplete chain as portal.elephas.com — leaf served without the
    Sectigo intermediate.
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: na.login.elephas.com
  https: true
  tls_version: TLSv1.3
  cert_issuer: GeoTrust TLS RSA CA G1 (DigiCert)
  cert_expires: Nov 16 23:59:59 2026 GMT
  chain_complete: true
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  note: Azure AD B2C custom-domain identity host for the Elephas tenant.
domains:
- domain: elephas.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
  note: 'DMARC policy is p=none — monitoring only, no enforcement against spoofed
    mail from the corporate domain.'
- domain: elephasapis.com
  dnssec: false
  caa: []
  spf: false
  dmarc: false
  note: 'The API domain publishes neither SPF nor DMARC. It is an API-only domain
    that sends no mail, so the gap is low-impact, but a null SPF/DMARC record would
    close it explicitly.'
response_security_headers:
  observed_on: https://portal.elephasapis.com/swagger
  headers:
  - strict-transport-security: max-age=31536000;includeSubdomains
  - x-content-type-options: nosniff
  - content-security-policy: frame-ancestors 'none'
  - referrer-policy: no-referrer
  - cache-control: no-store, max-age=0, no-transform
  - permissions-policy: geolocation=(self "https://portal.elephas.com"
      "https://portal.elephasapis.com")
  note: The API returns a solid, deliberately configured security-header set on
    unauthenticated responses.
findings:
- id: incomplete-tls-chain
  severity: medium
  hosts: [portal.elephas.com, portal.elephasapis.com]
  detail: Leaf certificate served without its issuing intermediate; strict TLS
    clients cannot build a path to a trusted root.
- id: no-caa-records
  severity: low
  domains: [elephas.com, elephasapis.com]
  detail: No CAA records, so any public CA may issue for these names.
- id: dmarc-not-enforcing
  severity: low
  domains: [elephas.com]
  detail: DMARC exists but is p=none.