Invalid SSL Certificate
Severity: Medium
Summary
Netsparker identified an invalid SSL certificate.
An SSL certificate can be created and signed by anyone. You should have a valid SSL certificate to make your visitors sure about the secure communication between your website and them. If you have an invalid certificate, your visitors will have trouble distinguishing between your certificate and those of attackers.
Impact
Attackers can perform man-in-the-middle attacks and observe the encryption traffic between your website and its visitors.
Remediation
Fix the problem with your SSL certificate to provide secure communication between your website and its visitors.
Classifications
PCI v3.1-6.5.4, PCI v3.2-6.5.4, CAPEC-459, WASC-4, OWASP 2013-A6, OWASP 2017-A3
, CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Netsparker Security Insights
- Exposing the Public IPs of Tor Services Through SSL Certificates
- Final Nail in the Coffin of HTTP: Chrome 68 and SSL/TLS Implementation
- Netsparker's Weekly Security Roundup 2018 – Week 02
- Netsparker Cloud Updated with New Security Checks and Several Other Service Improvements
- Netsparker Desktop Updated with DROWN SSL/TLS Security Check and More
Helpful Use Cases
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Tags
