Quick Answer: TLS (Transport Layer Security) misconfiguration refers to insecure settings on an HTTPS service: expired or invalid certificates, weak cipher suites (RC4, 3DES, EXPORT ciphers), deprecated protocol versions (SSLv3, TLS 1.0, TLS 1.1), or missing HSTS headers. These misconfigurations expose users to man-in-the-middle attacks, connection interception, and protocol downgrade attacks.
What are the main types of TLS misconfiguration?
- Expired certificate — the TLS certificate's validity period has passed. Browsers show a security warning and users cannot connect without bypassing the error. This is Critical severity in VeilScan.
- Weak cipher suites — cipher suites like RC4, 3DES, EXPORT, and NULL ciphers are cryptographically weak and susceptible to known attacks. They should not be advertised or accepted.
- Deprecated protocol versions — SSLv2, SSLv3, TLS 1.0, and TLS 1.1 are deprecated by major standards bodies and browsers. Accepting these versions enables downgrade attacks. PCI DSS explicitly prohibits TLS 1.0.
- Missing HSTS header — HTTP Strict Transport Security tells browsers to always use HTTPS for the domain. Without it, initial HTTP connections can be intercepted and downgraded before the redirect to HTTPS occurs.
- Invalid certificate chain — a certificate chain with missing intermediate certificates prevents verification in some clients.
Why does TLS misconfiguration matter for compliance?
PCI DSS v4.0 explicitly prohibits TLS 1.0 and strongly discourages TLS 1.1. ISO 27001 A.8.24 (Use of cryptography) and A.8.20 (Networks security) cover the use of strong cryptographic protocols. GDPR Article 32 requires "appropriate technical measures" for security, which includes not using deprecated cryptographic protocols when handling personal data.
How does VeilScan detect TLS misconfigurations?
VeilScan performs TLS checks against every live HTTPS host discovered during asset enumeration: certificate validity and expiry, negotiated cipher suites, accepted protocol versions, and HSTS header presence and value. See TLS and Email Security Checks feature.
What are common questions about TLS Misconfiguration?
What does TLS Misconfiguration mean in cybersecurity?
TLS Misconfiguration describes a security concept that affects how teams understand, monitor, and reduce external exposure across internet-facing assets.
Why does TLS Misconfiguration matter for external attack surface monitoring?
It matters because attackers continuously inspect public assets. Tracking this concept helps teams reduce exploitable exposure before it becomes a breach path.
How does VeilScan help with TLS Misconfiguration?
VeilScan discovers public assets, validates findings with proof, prioritises issues by business impact, and explains remediation in reports built for engineering and leadership.
What related terms should you read next?