Skip to main content

Pro audit program · v1.0

TLS / Certificate Hygiene

TLS configuration + cert lifecycle — every breach starts with somebody not noticing a cert expired or a weak cipher enabled.

  • General target area
  • NIST 800-52 framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

TLS configuration + cert lifecycle — every breach starts with somebody not noticing a cert expired or a weak cipher enabled.

Risks addressed

  • High Expired cert breaks customer-facing service
  • High Weak ciphers (TLS 1.0 / RC4) downgraded by attacker
  • Critical Private keys exposed in code repos

Controls (7)

  1. Inventory of all certificates + owners

    High

    Inventory of all certificates + owners

    How to test + evidence

    Testing procedure: Cert management tool tracks every public + internal cert with owner + expiry.

    Evidence to collect: Cert inventory export.

  2. Auto-renewal where possible

    High

    Auto-renewal where possible

    How to test + evidence

    Testing procedure: ACME (Let's Encrypt / equivalent) or vendor automation renews 30+ days before expiry.

    Evidence to collect: Renewal automation evidence.

  3. Expiry alerts at 30 + 14 + 7 days

    High

    Expiry alerts at 30 + 14 + 7 days

    How to test + evidence

    Testing procedure: Monitoring fires alerts at multiple thresholds.

    Evidence to collect: Alert config + last alert.

  4. Only TLS 1.2+ enabled

    Critical

    Only TLS 1.2+ enabled

    How to test + evidence

    Testing procedure: No TLS 1.0 / 1.1. Use ssllabs.com / equivalent scan.

    Evidence to collect: SSL Labs report.

  5. Strong ciphers + perfect forward secrecy

    High

    Strong ciphers + perfect forward secrecy

    How to test + evidence

    Testing procedure: AEAD ciphers only; ECDHE key exchange.

    Evidence to collect: Cipher suite config.

  6. HSTS enabled on public sites

    Medium

    HSTS enabled on public sites

    How to test + evidence

    Testing procedure: Strict-Transport-Security header with includeSubDomains + preload.

    Evidence to collect: curl -I sample.

  7. Private keys vaulted

    High

    Private keys vaulted

    How to test + evidence

    Testing procedure: No keys in repos / on developer laptops.

    Evidence to collect: Secret scan + vault config.