{"sprite": "arclab-arc-failing", "role": "arc-failing", "title": "ARC #2: failing (Wavetronix Device certificate)", "host": "arclab-arc-failing-b2rc4.sprites.app", "url": "https://arclab-arc-failing-b2rc4.sprites.app", "uptime_s": 1099, "config": {"profile": "device", "kex": "rsa-only", "custom": {"cn": "Wavetronix Custom", "key_type": "rsa", "key_usage": ["digitalSignature", "keyEncipherment"], "ku_critical": true}}, "config_version": 1, "config_error": null, "kex": {"id": "rsa-only", "title": "RSA key transport only (today's ARC firmware)", "blurb": "The ARC only knows the old way: the phone encrypts the session secret with the ARC's certificate key. The certificate must therefore allow Key Encipherment.", "max_tls": "1.2", "cipher_lists": {"443": [{"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}], "10443": [{"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}]}}, "cert": {"subject": "Wavetronix Device", "subject_org": "Wavetronix", "issuer": "Wavetronix Lab Root CA", "issuer_org": "Wavetronix Lab", "publicly_trusted": false, "serial": "32ac0e9d6be1f198285c0964ff3f686df8face7", "not_before": "2026-10-11T05:08:14+00:00", "not_after": "2029-01-14T05:08:14+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "nonRepudiation"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Content Commitment (Non-Repudiation)"], "extended_key_usage": ["serverAuth", "clientAuth"], "sans": ["arclab-arc-failing-b2rc4.sprites.app", "arclab-arc-failing", "localhost", "127.0.0.1"], "sha256": "a3a9ef93f170f97a1f95471f169b003c59774a688eaa308966e20004807e8786", "may_encrypt_secret": false, "may_sign": true}, "profiles": {"arc": {"title": "Wavetronix Arc (working ARC)", "short": "Wavetronix Arc", "blurb": "The certificate found on ARC devices that work with the app. It has NO Key Usage extension, so nothing restricts how its key may be used.", "available": true}, "device": {"title": "Wavetronix Device (failing ARC)", "short": "Wavetronix Device", "blurb": "The certificate found on ARC devices that fail. Its Key Usage extension allows Digital Signature and Content Commitment only, NOT Key Encipherment.", "available": true, "cert": {"subject": "Wavetronix Device", "subject_org": "Wavetronix", "issuer": "Wavetronix Lab Root CA", "issuer_org": "Wavetronix Lab", "publicly_trusted": false, "serial": "32ac0e9d6be1f198285c0964ff3f686df8face7", "not_before": "2026-10-11T05:08:14+00:00", "not_after": "2029-01-14T05:08:14+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "nonRepudiation"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Content Commitment (Non-Repudiation)"], "extended_key_usage": ["serverAuth", "clientAuth"], "sans": ["arclab-arc-failing-b2rc4.sprites.app", "arclab-arc-failing", "localhost", "127.0.0.1"], "sha256": "a3a9ef93f170f97a1f95471f169b003c59774a688eaa308966e20004807e8786", "may_encrypt_secret": false, "may_sign": true}}, "fixed": {"title": "Wavetronix Device, re-issued with Key Encipherment", "short": "Wavetronix Device (fixed)", "blurb": "Same certificate as the failing one but with Key Encipherment added. This is what public CAs issue for RSA keys.", "available": true}, "le-rsa": {"title": "Let's Encrypt, RSA key (real, publicly trusted)", "short": "Let's Encrypt RSA", "blurb": "A real certificate from Let's Encrypt for this ARC's public hostname, with an RSA key. Public CAs always add Key Encipherment to RSA certificates.", "available": true, "cert": {"subject": "arclab-arc-failing-b2rc4.sprites.app", "subject_org": "", "issuer": "YR2", "issuer_org": "Let's Encrypt", "publicly_trusted": true, "serial": "6d6afe839984dc009a543a96347eff2b1ac", "not_before": "2026-10-12T04:20:46+00:00", "not_after": "2027-01-10T04:20:45+00:00", "key_type": "RSA", "key_bits": 2048, "key_usage": ["digitalSignature", "keyEncipherment"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature", "Key Encipherment"], "extended_key_usage": ["serverAuth"], "sans": ["arclab-arc-failing-b2rc4.sprites.app"], "sha256": "04d809bce654db8b57b6f7f7db6bdc83b7532795e6d0626225f297d2fe62c77d", "may_encrypt_secret": true, "may_sign": true}}, "le-ecdsa": {"title": "Let's Encrypt, ECDSA key (real, publicly trusted)", "short": "Let's Encrypt ECDSA", "blurb": "A real Let's Encrypt certificate with an ECDSA key. ECDSA keys cannot do RSA key transport at all, so an ARC using it MUST support ECDHE.", "available": true, "cert": {"subject": "arclab-arc-failing-b2rc4.sprites.app", "subject_org": "", "issuer": "YE1", "issuer_org": "Let's Encrypt", "publicly_trusted": true, "serial": "5fc8da293f9737c6b81c1c148e567a9fb3c", "not_before": "2026-10-12T04:20:49+00:00", "not_after": "2027-01-10T04:20:48+00:00", "key_type": "ECDSA (secp256r1)", "key_bits": 256, "key_usage": ["digitalSignature"], "key_usage_critical": true, "key_usage_friendly": ["Digital Signature"], "extended_key_usage": ["serverAuth"], "sans": ["arclab-arc-failing-b2rc4.sprites.app"], "sha256": "0cf0e5c09ef81113ba91aa6705b5241d218595059ca64f24e9b3a0f208ef834a", "may_encrypt_secret": false, "may_sign": true}}, "custom": {"title": "Custom certificate (build your own)", "short": "Custom", "blurb": "Pick the key type and the Key Usage bits yourself and see what happens.", "available": true}}, "kex_modes": {"rsa-only": {"title": "RSA key transport only (today's ARC firmware)", "blurb": "The ARC only knows the old way: the phone encrypts the session secret with the ARC's certificate key. The certificate must therefore allow Key Encipherment."}, "ecdhe": {"title": "ECDHE enabled, TLS 1.2 (RSA key transport kept as fallback)", "blurb": "The ARC prefers ephemeral Diffie-Hellman: the certificate key only signs. Digital Signature is enough, and every session gets forward secrecy."}, "tls13": {"title": "TLS 1.3 (ECDHE for TLS 1.2 clients)", "blurb": "Modern TLS: key transport no longer exists, the certificate key is only ever used to sign."}}, "listeners": [{"port": 443, "service": "HTTPS REST API"}, {"port": 10443, "service": "EMP"}], "counters": {"ok": 21, "failed": 38}, "recent": [{"ts": 1791789305.7373848, "time": "2026-10-12T07:15:05.737+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:33090", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789305.780407, "time": "2026-10-12T07:15:05.780+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:36762", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789305.8495634, "time": "2026-10-12T07:15:05.849+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:33114", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789328.47263, "time": "2026-10-12T07:15:28.472+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:34950", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789328.5345347, "time": "2026-10-12T07:15:28.534+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60376", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789328.5903652, "time": "2026-10-12T07:15:28.590+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:34974", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789328.6498375, "time": "2026-10-12T07:15:28.649+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60394", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["x25519", "secp256r1", "secp384r1"], "sigalgs": ["ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512", "rsa_pkcs1_sha1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789331.1189692, "time": "2026-10-12T07:15:31.118+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:34992", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 15, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"], "sigalgs": ["0xbaba", "0x904", "0x905", "0x906", "ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512"], "alpn": ["h2", "http/1.1"], "sni": "arclab-arc-failing-b2rc4.sprites.app"}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)", "stage": "client-aborted-after-certificate", "explanation": "The ARC sent its certificate and waited for the encrypted secret, but the phone hung up. The certificate says its key may NOT be used for Key Encipherment, so a strict client (BoringSSL: Flutter, iOS, Android, Chrome) refuses to encrypt the secret with it.", "ms": 7}, {"ts": 1791789332.5487216, "time": "2026-10-12T07:15:32.548+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:34996", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}], "n_ciphers": 15, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"], "sigalgs": ["0x8a8a", "0x904", "0x905", "0x906", "ecdsa_secp256r1_sha256", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha256", "ecdsa_secp384r1_sha384", "rsa_pss_rsae_sha384", "rsa_pkcs1_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha512"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "alpn": ["h2", "http/1.1"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "failed", "error": "[SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN] ssl/tls alert certificate unknown (_ssl.c:1032)", "stage": "client-rejected-trust", "explanation": "The client did not trust the certificate (it sent a TLS alert).", "ms": 7}, {"ts": 1791789333.5255747, "time": "2026-10-12T07:15:33.525+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:35012", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 13, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 1}, {"ts": 1791789333.525377, "time": "2026-10-12T07:15:33.525+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60402", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}], "n_ciphers": 30, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-failing tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "ms": 7}, {"ts": 1791789333.5538661, "time": "2026-10-12T07:15:33.553+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60434", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}], "n_ciphers": 17, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 1}, {"ts": 1791789333.552823, "time": "2026-10-12T07:15:33.552+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:35028", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}], "n_ciphers": 17, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 2}, {"ts": 1791789333.5564802, "time": "2026-10-12T07:15:33.556+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:35056", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}], "n_ciphers": 30, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "alpn": ["h2", "http/1.1"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "GET /api/hello HTTP/1.1", "response": "200 OK (523 bytes)", "ms": 8}, {"ts": 1791789333.5892751, "time": "2026-10-12T07:15:33.589+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:35068", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}], "n_ciphers": 30, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "0x301", "0x302", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "", "response": "200 OK (514 bytes)", "ms": 10}, {"ts": 1791789333.6431818, "time": "2026-10-12T07:15:33.643+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:35082", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "", "response": "200 OK (514 bytes)", "ms": 9}, {"ts": 1791789333.672719, "time": "2026-10-12T07:15:33.672+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60458", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 13, "offers_rsa_key_transport": false, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": [], "expected_cipher": null, "result": "failed", "error": "[SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1032)", "stage": "no-common-cipher", "explanation": "The client does not offer RSA key transport at all (modern clients dropped it) and this ARC offers nothing else. With no method in common, the ARC gave up.", "ms": 1}, {"ts": 1791789333.7117534, "time": "2026-10-12T07:15:33.711+00:00", "port": 443, "service": "HTTPS REST API", "peer": "fdf::2:35112", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x00A3", "name": "UNKNOWN_0x00A3", "kex": "other"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC0AD", "name": "UNKNOWN_0xC0AD", "kex": "other"}, {"id": "0xC09F", "name": "UNKNOWN_0xC09F", "kex": "other"}, {"id": "0xC05D", "name": "UNKNOWN_0xC05D", "kex": "other"}, {"id": "0xC061", "name": "UNKNOWN_0xC061", "kex": "other"}, {"id": "0xC057", "name": "UNKNOWN_0xC057", "kex": "other"}, {"id": "0xC053", "name": "UNKNOWN_0xC053", "kex": "other"}, {"id": "0x00A7", "name": "UNKNOWN_0x00A7", "kex": "other"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x00A2", "name": "UNKNOWN_0x00A2", "kex": "other"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC0AC", "name": "UNKNOWN_0xC0AC", "kex": "other"}, {"id": "0xC09E", "name": "UNKNOWN_0xC09E", "kex": "other"}, {"id": "0xC05C", "name": "UNKNOWN_0xC05C", "kex": "other"}, {"id": "0xC060", "name": "UNKNOWN_0xC060", "kex": "other"}, {"id": "0xC056", "name": "UNKNOWN_0xC056", "kex": "other"}, {"id": "0xC052", "name": "UNKNOWN_0xC052", "kex": "other"}, {"id": "0x00A6", "name": "UNKNOWN_0x00A6", "kex": "other"}, {"id": "0xC0AF", "name": "UNKNOWN_0xC0AF", "kex": "other"}, {"id": "0xC0AE", "name": "UNKNOWN_0xC0AE", "kex": "other"}, {"id": "0xC0A3", "name": "UNKNOWN_0xC0A3", "kex": "other"}, {"id": "0xC0A2", "name": "UNKNOWN_0xC0A2", "kex": "other"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x006A", "name": "UNKNOWN_0x006A", "kex": "other"}, {"id": "0xC073", "name": "UNKNOWN_0xC073", "kex": "other"}, {"id": "0xC077", "name": "UNKNOWN_0xC077", "kex": "other"}, {"id": "0x00C4", "name": "UNKNOWN_0x00C4", "kex": "other"}, {"id": "0x00C3", "name": "UNKNOWN_0x00C3", "kex": "other"}, {"id": "0x006D", "name": "UNKNOWN_0x006D", "kex": "other"}, {"id": "0x00C5", "name": "UNKNOWN_0x00C5", "kex": "other"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0040", "name": "UNKNOWN_0x0040", "kex": "other"}, {"id": "0xC072", "name": "UNKNOWN_0xC072", "kex": "other"}, {"id": "0xC076", "name": "UNKNOWN_0xC076", "kex": "other"}, {"id": "0x00BE", "name": "UNKNOWN_0x00BE", "kex": "other"}, {"id": "0x00BD", "name": "UNKNOWN_0x00BD", "kex": "other"}, {"id": "0x006C", "name": "UNKNOWN_0x006C", "kex": "other"}, {"id": "0x00BF", "name": "UNKNOWN_0x00BF", "kex": "other"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0038", "name": "UNKNOWN_0x0038", "kex": "other"}, {"id": "0x0088", "name": "UNKNOWN_0x0088", "kex": "other"}, {"id": "0x0087", "name": "UNKNOWN_0x0087", "kex": "other"}, {"id": "0xC019", "name": "UNKNOWN_0xC019", "kex": "other"}, {"id": "0x003A", "name": "UNKNOWN_0x003A", "kex": "other"}, {"id": "0x0089", "name": "UNKNOWN_0x0089", "kex": "other"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0032", "name": "UNKNOWN_0x0032", "kex": "other"}, {"id": "0x0045", "name": "UNKNOWN_0x0045", "kex": "other"}, {"id": "0x0044", "name": "UNKNOWN_0x0044", "kex": "other"}, {"id": "0xC018", "name": "UNKNOWN_0xC018", "kex": "other"}, {"id": "0x0034", "name": "UNKNOWN_0x0034", "kex": "other"}, {"id": "0x0046", "name": "UNKNOWN_0x0046", "kex": "other"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0xC09D", "name": "UNKNOWN_0xC09D", "kex": "other"}, {"id": "0xC051", "name": "UNKNOWN_0xC051", "kex": "other"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0xC09C", "name": "UNKNOWN_0xC09C", "kex": "other"}, {"id": "0xC050", "name": "UNKNOWN_0xC050", "kex": "other"}, {"id": "0xC0A1", "name": "UNKNOWN_0xC0A1", "kex": "other"}, {"id": "0xC0A0", "name": "UNKNOWN_0xC0A0", "kex": "other"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x00C0", "name": "UNKNOWN_0x00C0", "kex": "other"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x00BA", "name": "UNKNOWN_0x00BA", "kex": "other"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x0084", "name": "UNKNOWN_0x0084", "kex": "other"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0041", "name": "UNKNOWN_0x0041", "kex": "other"}], "n_ciphers": 86, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "ecdsa_sha1", "0x301", "rsa_pkcs1_sha1", "0x302", "0x202", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"], "expected_cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_128_CBC_SHA", "cipher_openssl": "AES128-SHA", "cipher_id": "0x002F", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "request": "", "app_note": "client closed the connection after the handshake without finishing the exchange (EOF occurred in violation of protocol (_ssl.c:2500))", "ms": 9}, {"ts": 1791789333.7207274, "time": "2026-10-12T07:15:33.720+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60468", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0x00A3", "name": "UNKNOWN_0x00A3", "kex": "other"}, {"id": "0x009F", "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCAA", "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC0AD", "name": "UNKNOWN_0xC0AD", "kex": "other"}, {"id": "0xC09F", "name": "UNKNOWN_0xC09F", "kex": "other"}, {"id": "0xC05D", "name": "UNKNOWN_0xC05D", "kex": "other"}, {"id": "0xC061", "name": "UNKNOWN_0xC061", "kex": "other"}, {"id": "0xC057", "name": "UNKNOWN_0xC057", "kex": "other"}, {"id": "0xC053", "name": "UNKNOWN_0xC053", "kex": "other"}, {"id": "0x00A7", "name": "UNKNOWN_0x00A7", "kex": "other"}, {"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0x00A2", "name": "UNKNOWN_0x00A2", "kex": "other"}, {"id": "0x009E", "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC0AC", "name": "UNKNOWN_0xC0AC", "kex": "other"}, {"id": "0xC09E", "name": "UNKNOWN_0xC09E", "kex": "other"}, {"id": "0xC05C", "name": "UNKNOWN_0xC05C", "kex": "other"}, {"id": "0xC060", "name": "UNKNOWN_0xC060", "kex": "other"}, {"id": "0xC056", "name": "UNKNOWN_0xC056", "kex": "other"}, {"id": "0xC052", "name": "UNKNOWN_0xC052", "kex": "other"}, {"id": "0x00A6", "name": "UNKNOWN_0x00A6", "kex": "other"}, {"id": "0xC0AF", "name": "UNKNOWN_0xC0AF", "kex": "other"}, {"id": "0xC0AE", "name": "UNKNOWN_0xC0AE", "kex": "other"}, {"id": "0xC0A3", "name": "UNKNOWN_0xC0A3", "kex": "other"}, {"id": "0xC0A2", "name": "UNKNOWN_0xC0A2", "kex": "other"}, {"id": "0xC024", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0xC028", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "kex": "ecdhe"}, {"id": "0x006B", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x006A", "name": "UNKNOWN_0x006A", "kex": "other"}, {"id": "0xC073", "name": "UNKNOWN_0xC073", "kex": "other"}, {"id": "0xC077", "name": "UNKNOWN_0xC077", "kex": "other"}, {"id": "0x00C4", "name": "UNKNOWN_0x00C4", "kex": "other"}, {"id": "0x00C3", "name": "UNKNOWN_0x00C3", "kex": "other"}, {"id": "0x006D", "name": "UNKNOWN_0x006D", "kex": "other"}, {"id": "0x00C5", "name": "UNKNOWN_0x00C5", "kex": "other"}, {"id": "0xC023", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0xC027", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0067", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "kex": "ecdhe"}, {"id": "0x0040", "name": "UNKNOWN_0x0040", "kex": "other"}, {"id": "0xC072", "name": "UNKNOWN_0xC072", "kex": "other"}, {"id": "0xC076", "name": "UNKNOWN_0xC076", "kex": "other"}, {"id": "0x00BE", "name": "UNKNOWN_0x00BE", "kex": "other"}, {"id": "0x00BD", "name": "UNKNOWN_0x00BD", "kex": "other"}, {"id": "0x006C", "name": "UNKNOWN_0x006C", "kex": "other"}, {"id": "0x00BF", "name": "UNKNOWN_0x00BF", "kex": "other"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0039", "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0038", "name": "UNKNOWN_0x0038", "kex": "other"}, {"id": "0x0088", "name": "UNKNOWN_0x0088", "kex": "other"}, {"id": "0x0087", "name": "UNKNOWN_0x0087", "kex": "other"}, {"id": "0xC019", "name": "UNKNOWN_0xC019", "kex": "other"}, {"id": "0x003A", "name": "UNKNOWN_0x003A", "kex": "other"}, {"id": "0x0089", "name": "UNKNOWN_0x0089", "kex": "other"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0033", "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0x0032", "name": "UNKNOWN_0x0032", "kex": "other"}, {"id": "0x0045", "name": "UNKNOWN_0x0045", "kex": "other"}, {"id": "0x0044", "name": "UNKNOWN_0x0044", "kex": "other"}, {"id": "0xC018", "name": "UNKNOWN_0xC018", "kex": "other"}, {"id": "0x0034", "name": "UNKNOWN_0x0034", "kex": "other"}, {"id": "0x0046", "name": "UNKNOWN_0x0046", "kex": "other"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0xC09D", "name": "UNKNOWN_0xC09D", "kex": "other"}, {"id": "0xC051", "name": "UNKNOWN_0xC051", "kex": "other"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0xC09C", "name": "UNKNOWN_0xC09C", "kex": "other"}, {"id": "0xC050", "name": "UNKNOWN_0xC050", "kex": "other"}, {"id": "0xC0A1", "name": "UNKNOWN_0xC0A1", "kex": "other"}, {"id": "0xC0A0", "name": "UNKNOWN_0xC0A0", "kex": "other"}, {"id": "0x003D", "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "kex": "rsa"}, {"id": "0x00C0", "name": "UNKNOWN_0x00C0", "kex": "other"}, {"id": "0x003C", "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "kex": "rsa"}, {"id": "0x00BA", "name": "UNKNOWN_0x00BA", "kex": "other"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x0084", "name": "UNKNOWN_0x0084", "kex": "other"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0041", "name": "UNKNOWN_0x0041", "kex": "other"}], "n_ciphers": 86, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "x448", "secp384r1", "secp521r1", "ffdhe2048", "ffdhe3072"], "sigalgs": ["0x905", "0x906", "0x904", "ecdsa_secp256r1_sha256", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512", "ed25519", "ed448", "0x81a", "0x81b", "0x81c", "0x809", "0x80a", "0x80b", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "0x303", "ecdsa_sha1", "0x301", "rsa_pkcs1_sha1", "0x302", "0x202", "0x402", "0x502", "0x602"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-failing tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "app_note": "client closed the connection after the handshake without finishing the exchange (BrokenPipeError: [Errno 32] Broken pipe)", "ms": 11}, {"ts": 1791789333.8404038, "time": "2026-10-12T07:15:33.840+00:00", "port": 10443, "service": "EMP", "peer": "fdf::2:60482", "client_hello": {"legacy_version": "TLS 1.2", "ciphers": [{"id": "0xC02B", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02F", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "kex": "ecdhe"}, {"id": "0xC02C", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xC030", "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "kex": "ecdhe"}, {"id": "0xCCA9", "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xCCA8", "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "kex": "ecdhe"}, {"id": "0xC009", "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC013", "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC00A", "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0xC014", "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "kex": "ecdhe"}, {"id": "0x009C", "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "kex": "rsa"}, {"id": "0x009D", "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "kex": "rsa"}, {"id": "0x002F", "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "kex": "rsa"}, {"id": "0x0035", "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "kex": "rsa"}, {"id": "0x1301", "name": "TLS_AES_128_GCM_SHA256", "kex": "tls13"}, {"id": "0x1302", "name": "TLS_AES_256_GCM_SHA384", "kex": "tls13"}, {"id": "0x1303", "name": "TLS_CHACHA20_POLY1305_SHA256", "kex": "tls13"}], "n_ciphers": 17, "offers_rsa_key_transport": true, "offers_ecdhe": true, "offers_tls13": true, "supported_versions": ["TLS 1.3", "TLS 1.2"], "sni": "arclab-arc-failing-b2rc4.sprites.app", "groups": ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1", "secp521r1"], "sigalgs": ["rsa_pss_rsae_sha256", "ecdsa_secp256r1_sha256", "ed25519", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha512", "rsa_pkcs1_sha256", "rsa_pkcs1_sha384", "rsa_pkcs1_sha512", "ecdsa_secp384r1_sha384", "ecdsa_secp521r1_sha512"]}, "server": {"profile": "device", "profile_title": "Wavetronix Device (failing ARC)", "kex": "rsa-only", "kex_title": "RSA key transport only (today's ARC firmware)", "cert_subject": "Wavetronix Device", "key_type": "RSA", "key_usage": ["digitalSignature", "nonRepudiation"], "may_encrypt_secret": false, "may_sign": true}, "negotiable": ["TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"], "expected_cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "result": "ok", "tls_version": "TLSv1.2", "cipher": "TLS_RSA_WITH_AES_256_GCM_SHA384", "cipher_openssl": "AES256-GCM-SHA384", "cipher_id": "0x009D", "kex": "rsa", "kex_label": "RSA key transport (certificate key encrypts the secret)", "response": "EMP/1.0 READY device=arclab-arc-failing tls=TLSv1.2 cipher=TLS_RSA_WITH_AES_256_GCM_SHA384", "ms": 7}], "now": 1791789359.8095906}