Security finding
The certificates and the hosts of the domain do not line up
Security Warning Severity: Medium
Part of the audit Certificates and the hosts in use do not line up. Finding id: security.certificateVsHosts.
What it costs you
A host the site uses without a matching certificate shows visitors a browser warning. Certificates nobody tracks expire unnoticed.
What to do
Keep one list of hosts and their certificates. Cover every host the site uses, and account for every certificate the logs show.
What it checks
- Linked host not covered by certificate
- Certificate for host that no longer exists
- Different issuers or expiry dates across hosts
- Wildcard certificate alongside forgotten ones
How to fix it
Cover the linked host
- Issue a certificate that names [host] and install it on the server that answers for it.
- If the host should not be used, remove the links to it.
How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Account for a certificate of a host that is gone
- Ask hosting, CDN and tool owners who ordered the certificate for [host].
- If nobody needs it, ask the issuer ([issuer]) to revoke it, or let it run out in [days left] days.
How to check: The certificate logs show no valid certificate for [host], or the certificate is marked as known.
Remove the leftover single certificate
- Find the server that still holds the certificate and key for [host].
- Switch that server to the wildcard certificate, or take the old certificate and key off it.
How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
One renewal routine
- List the hosts with their issuer and expiry date. The rows of this finding are that list.
- Move renewal to one automated tool where you can, and put the rest in a shared calendar.
How to check: Recrawl: one issuer, or every expiry date is in the calendar.
A real case
A study of certificate transparency logs found millions of websites still offering an expired certificate, and those hosts more often ran software with known flaws: 69% against 49% in a comparison group for one Apache flaw.
How to verify by hand
Certificate transparency logs for the domain.
What this relies on
Every host the site links to should be covered and known.