SSL/TLS Certificates Expiring Soon

Risk: potentially

Description

SSL/TLS certificates nearing their expiration date pose a critical risk to service continuity and security. Certificates that are set to expire within the next 30 days require immediate attention to avoid disruptions.

Key Points:

• Approaching Expiration: Certificates within 30 days of expiration need proactive monitoring to prevent service interruptions.
• User Trust: Browsers may display warnings for certificates close to expiring, which can erode user trust and drive visitors away.
• Compliance Risks: Many regulatory standards mandate up-to-date SSL/TLS certificates for compliance, and neglecting expiring certificates can result in non-compliance.

Recommendation

To mitigate the risks associated with certificates that are expiring soon, consider the following:

• Implement automated monitoring with alerts set at 90, 60, and 30 days before expiration.
• Establish a documented process for certificate renewal, involving all responsible parties.
• Use automated tools, such as ACME (Automated Certificate Management Environment), for certificate renewal and issuance.

Detect this with Ostorlab

Ostorlab checks web applications, APIs and networks for this issue.

Create an account

Links

• NIST Guidelines for Key Management
• SSL Labs Best Practices

Standards

• SOC2_CONTROLS:
  • CC_6_7
  • CC_7_1
• CCPA:
  • CCPA_1798_150
• GDPR:
  • ART_32
• PCI_STANDARDS:
  • REQ_4_1
  • REQ_6_2
• OWASP_TOP_10:
  • A02_2021