Invalid SSL Certificate

Severity: Medium

Summary#

Invicti identified an invalid SSL certificate.

An SSL certificate can be created and signed by anyone. You should have a valid SSL certificate to make your visitors sure about the secure communication between your website and them. If you have an invalid certificate, your visitors will have trouble distinguishing between your certificate and those of attackers.

Impact#

Attackers can perform man-in-the-middle attacks and observe the encryption traffic between your website and its visitors.

Remediation#

Fix the problem with your SSL certificate to provide secure communication between your website and its visitors.

Classifications#

OWASP 2013-A6, OWASP 2017-A3, ISO27001-A.14.1.3, PCI v3.2-6.5.4, WASC-4, CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-295, CAPEC-459

Invicti Security Insights

Final Nail in the Coffin of HTTP: Chrome 68 and SSL/TLS Implementation

Invalid SSL Certificate

Related Articles

Build your resistance to threats. And save hundreds of hours each month.