Configuration: Self Signed SSL Certificate¶

Identifier: self_signed_ssl

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

Self-signed SSL certificates are not issued by a certificate authority and do not provide trust value, potentially making connections vulnerable to man-in-the-middle attacks.

How we test: We analyze SSL/TLS certificates to detect if they are self-signed by checking if certificates are issued by recognized certificate authorities. We verify certificate chain of trust and identify if self-signed certificates are being used.

Reference:

https://www.rapid7.com/db/vulnerabilities/ssl-self-signed-certificate/

Configuration¶

Example¶

Example configuration:

---
security_tests:
  self_signed_ssl:
    skip: false

Reference¶

`skip`¶

Type : boolean

Skip the test if true.