Security finding
A host uses a weak certificate key or signature, or no forward secrecy
Security Warning Severity: Medium
Part of the audit TLS certificate and configuration. Finding id: security.tlsKeyAndForwardSecrecy.
What it costs you
The connection is protected less than the padlock suggests.
What to do
Fix the certificate or the TLS settings of [host].
What it checks
- Past traffic not protected if key leaks
- Certificate key is too weak
- Certificate signed with a weak method
How to fix it
Offer forward secrecy
- Allow TLS 1.3 on the server, CDN or load balancer that ends TLS for [host]. Every TLS 1.3 cipher suite has forward secrecy.
- For TLS 1.2, put ECDHE cipher suites in the list and before the others, and remove suites with plain RSA key exchange once old clients allow it.
- We do not give a cipher list, because the right one depends on the server and the clients you must support.
How to check: openssl s_client -connect [host]:443 -servername [host] -tls1_2 </dev/null 2>/dev/null | grep -i 'cipher' (the cipher starts with ECDHE)
Issue a new certificate
- Create a new private key, RSA [min rsa bits] bits or more or ECDSA P-256, and a certificate signing request for it.
- Have it issued by a public certificate authority, which signs with SHA-256 or better, and install it with the authority's current intermediate certificates.
- If a CDN or hosting platform provides the certificate, ask it to reissue.
How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | openssl x509 -noout -text | grep -E 'Public-Key|Signature Algorithm'
Thresholds
| Name | Default | Meaning |
|---|---|---|
min_rsa_bits | 2048 | Smallest acceptable RSA key, in bits. Starting value, from the CA/Browser Forum minimum. |
min_ec_bits | 256 | Smallest acceptable ECDSA curve, in bits. Starting value, from the CA/Browser Forum minimum (P-256). |