TLS & PKI Assessment

This guide treats TLS endpoints and certificate infrastructure as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Inventory hostnames, listeners, certificate subjects, issuers, expiry, and ownership.

2. 02

   Map public, private, and mutual-TLS trust boundaries.

3. 03

   Record expected protocol versions and cipher policy.

4. 04

   Identify automation responsible for issuance and renewal.

openssl s_client -connect example.com:443 \
+  -servername example.com </dev/null 2>/dev/null \
+  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm hostname and chain validation from an approved client.

2. 02

   Check that deprecated protocol versions are disabled.

3. 03

   Verify client-certificate enforcement where mTLS is required.

4. 04

   Test renewal and revocation procedures through administrative evidence rather than disruptive expiry simulation.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Alert on unexpected certificate issuance and near-expiry certificates.
• Log failed handshakes and client-certificate validation failures.
• Track key custody, issuance owner, and renewal history.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Disable legacy protocols and weak policy exceptions.
• Automate issuance and renewal with scoped identities.
• Protect private keys and prefer hardware-backed custody for high-value roots.
• Document revocation and emergency replacement procedures.