漏洞修复：Often Misused: Weak SSL Certificate

2024-04-11 08:29:01

描述

WebInspect has identified a self-signed certificate served from the target server. Server certificates declare the public key of the server for use in transport layer security. Trusted third-party vendors known as Certificate Authority (CA) sign and issue the certificates to ensure that they are authentic and contain the public key of the intended server. The public key of the root CA is embedded in the operating system (OS) by the vendor (e.g., in Windows by Microsoft or in Mac OS by Apple). Upon receipt of a certificate, the client (e.g., a web browser) verifies the identity with the OS’s embedded trusted CA. In case of a self-signed certificate, the certificate is signed using its own private key, hence losing the ability for a client to verify its identity with a trusted CA. Since there is no third-party verification possible, an attacker can mount a man-in-the-middle impersonation attack by issuing a certificate with fake details and a public key that he controls. The client generates a security warning for a self-signed certificate, which a user can override. Users can inspect the certificate before allowing it to be trusted. However, a legitimate self-signed certificate from the intended site can encourage an insecure practice of overriding self-signed certificate warnings without inspecting details, which in turn can make users more susceptible to impersonation attacks.

解决方案

使用CA授权证书

CA授权的免费证书

Let’s Encrypt

参考

https://vulncat.fortify.com/en/detail?id=desc.dynamic.xtended_preview.often_misused_weak_ssl_certificate

漏洞修复：Often Misused: Weak SSL Certificate相关推荐

【漏洞修复】SSL/TLS协议信息泄露漏洞(CVE-2016-2183)
漏洞修复-SSL/TLS协议信息泄露漏洞(CVE-2016-2183)[原理扫描] @Time : 2022/10/20 09:30 @Author : 852782749@qq.com 开始编辑- ...
SSL 3.0 安全漏洞修复方法
SSL 3.0 安全漏洞修复方法 V2EX 谷歌今天披露了一个存在于 SSL 3.0 版本当中的安全漏洞,详细信息请访问: https://www.openssl.org/~bodo/ssl-pood ...
SSL Certificate Signed Using Weak Hashing Algorithm（CVE-2004-2761）
SSL Certificate Signed Using Weak Hashing Algorithm 操作系统版本:Windows Server 2012 R2 前言:解决SSL Certifica ...
linux禁用ssh弱加密算法,SSHSSL弱加密算法漏洞修复
一.SSH SSH的配置文件中加密算法没有指定,默认支持所有加密算法,包括arcfour,arcfour128,arcfour256等弱加密算法. 修改SSH配置文件,添加加密算法: vi /etc/ ...
SSHSSL弱加密算法漏洞修复
一.SSH SSH的配置文件中加密算法没有指定,默认支持所有加密算法,包括arcfour,arcfour128,arcfour256等弱加密算法. 修改SSH配置文件,添加加密算法: vi /etc/ ...
Drupal 网站漏洞修复以及网站安全防护加固方法
2019独角兽企业重金招聘Python工程师标准>>> drupal是目前网站系统使用较多一个开源PHP管理系统,架构使用的是php环境+mysql数据库的环境配置,drupal的代 ...
java+poodle漏洞修复_SSL3.0 POODLE漏洞修复方案
SSL3.0 POODLE漏洞修复方案发布时间:2014-10-15 15:02:27 关于SSLPOODLE漏洞 POODLE = Padding Oracle On Downgraded Leg ...
禁用sslv3协议linux,SSLv3协议漏洞修复方法
SSL3.0被曝出存在协议漏洞:"通过此漏洞可以窃取客户端与server端使用SSLv3加密通信的明文内容,危害严重",目前官方暂无升级修复补丁和攻击利用方式公布. 最佳建议:&q ...
linux禁用ssh弱加密算法,ssh弱加密算法漏洞修复
8种机械键盘轴体对比本人程序员,要买一个写代码的键盘,请问红轴和茶轴怎么选? ssh弱加密算法漏洞修复 SSH弱加密算法漏洞修复 1.A security scan turned up two SS ...

最新文章

热门文章