Skip to main content
SSL/TLS is the encryption that protects traffic between a browser and a website. A misconfiguration is a mistake in how it is set up, such as an expired or untrusted certificate, a site that still answers over plain HTTP, or missing security headers that tell browsers how to protect the connection.

​
Why it matters

Without working SSL/TLS, anyone on the network path, for example on public Wi-Fi, can read logins, session tokens, and form data. If HTTPS is not enforced or HSTS is missing, an attacker can downgrade the connection and change the page before it reaches the browser, for example to inject a script or swap payment details. GDPR, HIPAA, and PCI DSS all expect sensitive data to be encrypted in transit, so a misconfigured customer-facing site can put a client out of compliance. Certificate warnings in the browser also drive visitors away and make the site look compromised even when it is not. Email encryption is checked separately: Telivy’s mail authentication checks look for mail servers that do not support STARTTLS.

​
How Telivy rates severity

​
High

  • Certificate not found or no issuer. The site has no valid certificate, or the certificate has no identifiable issuer, so a secure connection cannot be established or trusted. This leaves it open to man-in-the-middle attacks.
  • Revoked certificate. The certificate authority has revoked the certificate and it should no longer be trusted.
  • HTTPS not enforced. The site does not redirect HTTP to HTTPS, so connections can be made, or downgraded, without encryption.

​
Medium

  • Expired or expiring certificate. The certificate has expired or expires within 30 days.
  • Self-signed certificate. Browsers show security warnings for self-signed certificates on public sites.
  • Weak signing algorithm. The certificate is signed with a hash weaker than SHA-256, which makes forgery easier.
  • Missing Content Security Policy (CSP). Without a CSP header, the browser has no list of allowed script sources, which makes cross-site scripting and data injection easier.
  • Missing or misconfigured HSTS. A missing, short-lived, or wrongly scoped Strict-Transport-Security header leaves the site open to protocol downgrade and cookie hijacking.

​
Low

  • Overly broad CSP. A Content Security Policy built on wildcards gives much weaker protection than a tightly scoped one, even though a policy exists.
  • Excessive certificate validity. The certificate is valid for longer than the 398-day industry maximum, which extends the exposure window if the key is ever compromised.

​
How attackers exploit it

Attackers use these gaps for man-in-the-middle attacks, downgrade attacks that force a weaker protocol, session hijacking with stolen cookies, content injection, and phishing sites that copy a real one.

​
Remediation

  • Renew certificates before they expire and automate renewal where possible. SSL/TLS certificates covers certificate findings in Telivy.
  • Replace self-signed, revoked, or weakly signed certificates with ones from a trusted certificate authority.
  • Redirect all HTTP traffic to HTTPS and add an HSTS header with a long max-age.
  • Add a Content Security Policy and tighten wildcard directives over time.
  • Rescan after each change to confirm the finding is gone.