Skip to main content

Pro audit program · v1.0

TLS / Certificate Hygiene

TLS configuration + cert lifecycle — every breach starts with somebody not noticing a cert expired or a weak cipher enabled.

  • General target area
  • NIST 800-52 framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

TLS configuration + cert lifecycle — every breach starts with somebody not noticing a cert expired or a weak cipher enabled.

Risks addressed

  • High Expired cert breaks customer-facing service
  • High Weak ciphers (TLS 1.0 / RC4) downgraded by attacker
  • Critical Private keys exposed in code repos

Controls (7)

  1. Inventory of all certificates + owners

    High

    This control requires the organization to maintain a comprehensive, current inventory of all digital certificates (TLS/SSL, code signing, client authentication, email encryption, etc.) deployed across the enterprise, including certificate metadata such as issuer, validity period, key length, and designated owner…

    How to test + evidence

    Testing procedure: Cert management tool tracks every public + internal cert with owner + expiry.

    Evidence to collect: Cert inventory export.

  2. Auto-renewal where possible

    High

    This control ensures that digital certificates, domain registrations, software licenses, and subscriptions critical to security operations are configured to renew automatically before expiration. Auto-renewal prevents service disruptions, authentication failures, and trust relationship breakdowns that occur when certificates or entitlements lapse…

    How to test + evidence

    Testing procedure: ACME (Let's Encrypt / equivalent) or vendor automation renews 30+ days before expiry.

    Evidence to collect: Renewal automation evidence.

  3. Expiry alerts at 30 + 14 + 7 days

    High

    This control requires automated notifications to be triggered at 30, 14, and 7 days before the expiration of critical security assets such as digital certificates, credentials, licenses, contracts, or access privileges. The tiered alert schedule provides escalating opportunities for renewal…

    How to test + evidence

    Testing procedure: Monitoring fires alerts at multiple thresholds.

    Evidence to collect: Alert config + last alert.

  4. Only TLS 1.2+ enabled

    Critical

    This control mandates that all systems, applications, and network infrastructure exclusively use Transport Layer Security (TLS) version 1.2 or higher for encrypted communications, explicitly disabling older protocols including TLS 1.0, TLS 1.1, SSL 3.0, and SSL 2.0. Implementation typically involves…

    How to test + evidence

    Testing procedure: No TLS 1.0 / 1.1. Use ssllabs.com / equivalent scan.

    Evidence to collect: SSL Labs report.

  5. Strong ciphers + perfect forward secrecy

    High

    This control mandates the use of cryptographically strong cipher suites with perfect forward secrecy (PFS) for all encrypted communications. Strong ciphers include AES-256-GCM, ChaCha20-Poly1305, and other algorithms with key lengths ≥256 bits for symmetric encryption and ≥2048 bits for asymmetric…

    How to test + evidence

    Testing procedure: AEAD ciphers only; ECDHE key exchange.

    Evidence to collect: Cipher suite config.

  6. HSTS enabled on public sites

    Medium

    HTTP Strict Transport Security (HSTS) is a security header that instructs browsers to communicate with the web server exclusively over HTTPS, preventing protocol downgrade attacks and cookie hijacking. When enabled, the server sends a Strict-Transport-Security header containing directives such as…

    How to test + evidence

    Testing procedure: Strict-Transport-Security header with includeSubDomains + preload.

    Evidence to collect: curl -I sample.

  7. Private keys vaulted

    High

    Private keys vaulted is a control requiring all cryptographic private keys—including TLS/SSL certificates, SSH keys, code-signing keys, API keys, and encryption keys—to be stored in dedicated secrets management systems (vaults) with access controls, encryption at rest, and audit logging. Keys…

    How to test + evidence

    Testing procedure: No keys in repos / on developer laptops.

    Evidence to collect: Secret scan + vault config.