Security Test: TLS Configuration¶

Description¶

Default Severity: high

If TLS is set up incorrectly, data that should be encrypted might not be fully protected, letting attackers snoop or even tamper with information. Mistakes occur when developers use outdated protocols or weak ciphers, misconfigure certificate checks, or ignore the proper use of certificates, turning what should be a secure connection into a vulnerable one. If these missteps aren’t caught, attackers might impersonate servers or force weaker encryption, putting sensitive data like user credentials at risk. It's an easy trap—cutting corners on TLS configuration can leave the secure transmission of data open to interception and fraud.

Reference:

• https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
  • https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_SSL_TLS_Ciphers_Insufficient_Transport_Layer_Protection
  • https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices

Configuration¶

Identifier: protocol/tls_configuration_protocol

Examples¶

All configuration available:

checks:
  protocol/tls_configuration_protocol:
    skip: false # default

Compliance and Standards¶