Use consistent certificates
Summary
The system must use digital certificates with a consistent identification of the associated organization (service, server, etc.).
Description
This requirement indicates the importance of maintaining consistency in the identification information embedded within digital certificates used by the system. Digital certificates play an important role in authenticating and securing communication, and having consistent identification ensures trustworthiness, and effective management.
Consistent identification refers to maintaining uniform and accurate information within the digital certificates associated with the organization, service, server, or any entity using the certificates.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- CAPECâ„¢-475. Signature spoofing by improper validation
- CWEâ„¢-295. Improper certificate validation
- CWEâ„¢-297. Improper validation of certificate with host mismatch
- OWASP TOP 10-A7. Identification and authentication failures
- ISA/IEC 62443-IAC-1_8. Public key infrastructure (PKI) certificates
- PTES-6_7. Exploitation - Zero day angle
- PTES-7_4_2_7. Post exploitation - Pillaging (certificate authority)
- PTES-7_7. Post Exploitation - Persistence
- BSAFSS-EN_3-2. Software protects and validates encryption keys
- BSAFSS-EN_3-3. Software protects and validates encryption keys
- OWASP ASVS-10_3_1. Application integrity
- SIG Core-I_3_2_4_2. Application security
- Resolution SB 2021 2126-Art_30_1. Security in Electronic Channels - Digital Banking
- OWASP MASVS-NETWORK-2. The app performs identity pinning for all remote endpoints under the developer's control
Vulnerabilities
- 163.Insecure digital certificates
- 167.Insecure service configuration - Wireless Certificates
- 348.Insecure digital certificates - Lifespan
- 350.Insecure digital certificates - Chain of trust
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.