SSL Vulnerability

PAM360 scans SSL certificates in its repository and flags certificates that are prone to any vulnerability. This way, users are kept informed of certificates / server configurations that are insecure. Users can then take necessary remedial measures to replace or change the SSL certificates or server configurations. PAM360 scans your SSL environment for the following categories of vulnerability.

SSL Certificate Revocation Status
1.1 Certificate Revocation List (CRL)

1.2 Online Certificate Service Protocol (OCSP) Revocation Status
SSL End-Server Vulnerability
2.1 Heartbleed Bug

2.2 POODLE SSL

2.3 SSL 3.0 Enabled

2.4 Weak Cipher Suites
Key Takeaways
SSL Vulnerability Scan

1. SSL Certificate Revocation Status

This check is performed to get information about the revocation status of a selected certificate. If the certificate for any of your domains in use is revoked, you have to take steps to replace it immediately. Revocation status for a certificate is obtained using two methods.

1.1 Certificate Revocation List (CRL)

i. Error:

The selected certificate is revoked and can no longer be trusted.

ii. What's the issue?

Certificate Revocation List (CRL) is a list of SSL certificates that are revoked by the Certificate Authorities (CAs) before their expiration date. Certificates are revoked because of various reasons such as mis-issuances, private key compromise, CA compromise etc., CRLs are a kind of blacklist used by browsers to verify the validity of a certificate. Such tests are essential because, SSL certificates are the means by which browsers and users trust your identity and an invalid SSL certificate brings down their trust for your organization.

PAM360 checks CRL revocation status for your certificates and flags certificates that have been revoked.

Learn more about CRL

1.2 Online Certificate Service Protocol (OCSP) Revocation Status

i. Error:

The selected certificate is revoked and can no longer be trusted.

ii. What's the issue?

Online Certificate Service Protocol (OCSP) is an internet protocol used for obtaining the revocation status of a digital certificate. Web browsers send the certificate in question to the respective Certificate Authority (CA). The CA then returns the response - 'valid', 'revoked' or 'unknown'.

PAM360 checks OCSP revocation status for your certificates and flags certificates that have been revoked.

Learn more about OCSP revocation

iii. Workaround:

If any of the above tests render positive for certificate revocation, you have to immediately replace the particular certificate. Failing to do so might cause browsers to throw security errors for your website.

You can replace the revoked certificates with new certificates from trusted third parties directly from PAM360. Refer to the detailed help section to learn more about certificate request and deployment using PAM360.

2. SSL End-Server Vulnerability

End-server vulnerability is caused due to improper configuration of SSL protocol in your domain server. PAM360 tests your domain servers for the following end-server vulnerability.

2.1 Heartbleed Bug

i. Error:

The selected server is prone to Heartbleed vulnerability.

ii. What's the issue?

Heartbleed bug is a vulnerability in the OpenSSL, a popular open source cryptographic library that helps in the implementation of SSL and TLS protocols. This bug allows attackers to steal private keys attached to SSL certificates, usernames, passwords and other sensitive data without leaving a trace.

PAM360 checks your domain servers for Heartbleed bug vulnerability and flags the affected servers.

Learn more about Heartbleed bug

iii. Workaround

Patch your OpenSSL software. Replace the vulnerable versions with safe versions of the software.

2.2 POODLE SSL

i. Error:

The selected server is prone to POODLE attack.

ii. What's the issue?

The POODLE is a form of a man-in-the-middle attack that exploits the vulnerability in the CBC encryption scheme as implemented in the SSL 3.0 protocol. Though POODLE is not as serious as the Heatbleed vulnerability, best practices recommend you discover and mitigate the problem as quickly as possible.

PAM360 scans your servers and flags servers that are vulnerable to POODLE attack.

Learn more about POODLE

iii. Workaround:

Disable SSL 3.0 protocol and enable TLS protocols (1.0, 1.1 and 1.2) on the client-side. It's to be noted that by default, PAM360 disables SSL 3.0 protocol on the PAM360 server.

2.3 SSL 3.0 Enabled

i. Error

The selected server exploits the outdated SSL 3.0 protocol, which is prone to known vulnerabilities.

ii. What's the issue?

It has been discovered that SSL 3.0 protocol has a flaw in its design that makes it vulnerable to man-in-the-middle attacks. If you have a public facing website dealing with payments, you should immediately discover all servers that exploit SSL 3.0 and upgrade to TLS version.

PAM360 scans servers in your network and flags all servers that make use of this protocol.

Learn more about SSL 3.0 vulnerability

iii. Workaround:

Disable SSL 3.0 protocol and enable TLS protocols (1.0, 1.1 and 1.2) on the client-side. It's to be noted that by default, PAM360 disables SSL 3.0 protocol on the PAM360 server.

2.4 Weak Cipher Suites

i. Error:

The selected server exploits weak SSL ciphers,which is a medium risk vulnerability.

ii. What's the issue?

Many organizations knowingly or unknowingly exploit weak SSL protocols and cipher suites in their domain servers which makes their website vulnerable to various MITM attacks. To play safe, they have to identify those weak ciphers, disable them and re-configure the domain servers. By default, SSL 3.0 is disabled on PAM360 server, which is a weak SSL protocol. In addition, PAM360 scans the end-point servers and flags the weak ciphers used in the TLS (1.0,1.1 and 1.2) protocol.

iii. Workaround:

Disable weak cipher suites and re-configure your domain server.

3. Key Takeaways

Here's a quick summary on how PAM360 scans your domain servers for vulnerability.

PAM360 initially scans the domain servers (to which the selected SSL certificate is deployed) and flags the weak ciphers.
Your domain server is scanned for HEARTBLEED and POODLE vulnerability, followed by CRL and OCSP revocation statuses.
When one or more of the above vulnerability checks renders a positive result, PAM360 flags the particular certificate as vulnerable.
Also, you can schedule automatic periodic vulnerability checks for your SSL certificates using PAM360 and opt an e-mail notification to the administrators as and when the tests are completed.
PAM360 provides dedicated, comprehensive, periodic reports on SSL vulnerability.

4. SSL Vulnerability Scan

To perform SSL vulnerability check on your domain server, follow the below steps:

Navigate to Certificates >> Certificates.
Click on Vulnerability icon () present to the left of the required certificate.
You will be redirected to a window which displays the certificates and the list of servers in which it is deployed.
Click Scan. If you want to perform the vulnerability scan on SANs also, enable Include SAN check box. If you want to perform this scan only for the servers in which the particular certificate is deployed (as discovered by PAM360), enable Only deployed servers check box.
PAM360 runs the scan and displays the results in a separate window. It comprises of the following details:
1. IP address, Port corresponding to the domain server
2. CRL, OCSP revocation statuses
3. POODLE SSL, HEARTBLEED vulnerability status
4. Information on whether the current version of the certificate (version of certificate being scanned) is deployed on domain servers
5. List of insecure ciphers in SSL 3.0 and TLS (1.0, 1.1, 1.2) protocols in the domain server
Note: By default, SSL 3.0 protocol is disabled in PAM360 server for security purposes. To scan SSL 3.0 protocol on your domain servers, you have to first enable SSL 3.0 protocol on PAM360 server and then restart the server.

Click Export to export the report in the form of PDF or e-mail to specific mail ids for better interpretation.

To schedule automatic vulnerability scan,

Navigate to Admin >> SSH/SSL >> SSL Vulnerability
Enable scheduled task by selecting the Enable radio button.
Choose the recurrence type and specify the time interval
You can opt to receive e-mail notifications to specific email ids after every scan by enabling the Enable Report check box
To enable scanning SSL 3.0 protocol in domain servers, enable the same in PAM360 server by choosing the enable option.
Click Save. The scheduled task is saved and vulnerability scan is carried out as per the scheduled time interval.

Notes:

The above technique is used to perform vulnerability scan for all certificates in the PAM360 repository. To run the scan only for selected certificates, you can do so from the Admin >> SSH/SSL >> Schedules tab. Refer to the help section on schedules to learn how to schedule vulnerability scan for selected certificates.
To view the data generated from the SSL vulnerability scans, go to the Dashboard tab >> Keys Dashboard >> Vulnerabilities widget.
PAM360 generates instant, comprehensive reports on SSL Vulnerability for better interpretation, which can be accessed from Reports tab. To learn more, refer to the detailed help section on reports.


SSL Vulnerability PAM360 scans SSL certificates in its repository and flags certificates that are prone to any vulnerability. This way, users are kept informed of certificates / server configurations that are insecure. Users can then take necessary remedial measures to replace or change the SSL certificates or server configurations. PAM360 scans your SSL environment for the following categories of vulnerability. SSL Certificate Revocation Status 1.1 Certificate Revocation List (CRL) 1.2 Online Certificate Service Protocol (OCSP) Revocation Status SSL End-Server Vulnerability 2.1 Heartbleed Bug 2.2 POODLE SSL 2.3 SSL 3.0 Enabled 2.4 Weak Cipher Suites Key Takeaways SSL Vulnerability Scan 1. SSL Certificate Revocation Status This check is performed to get information about the revocation status of a selected certificate. If the certificate for any of your domains in use is revoked, you have to take steps to replace it immediately. Revocation status for a certificate is obtained using two methods. 1.1 Certificate Revocation List (CRL) i. Error: The selected certificate is revoked and can no longer be trusted. ii. What's the issue? Certificate Revocation List (CRL) is a list of SSL certificates that are revoked by the Certificate Authorities (CAs) before their expiration date. Certificates are revoked because of various reasons such as mis-issuances, private key compromise, CA compromise etc., CRLs are a kind of blacklist used by browsers to verify the validity of a certificate. Such tests are essential because, SSL certificates are the means by which browsers and users trust your identity and an invalid SSL certificate brings down their trust for your organization. PAM360 checks CRL revocation status for your certificates and flags certificates that have been revoked. Learn more about CRL 1.2 Online Certificate Service Protocol (OCSP) Revocation Status i. Error: The selected certificate is revoked and can no longer be trusted. ii. What's the issue? Online Certificate Service Protocol (OCSP) is an internet protocol used for obtaining the revocation status of a digital certificate. Web browsers send the certificate in question to the respective Certificate Authority (CA). The CA then returns the response - 'valid', 'revoked' or 'unknown'. PAM360 checks OCSP revocation status for your certificates and flags certificates that have been revoked. Learn more about OCSP revocation iii. Workaround: If any of the above tests render positive for certificate revocation, you have to immediately replace the particular certificate. Failing to do so might cause browsers to throw security errors for your website. You can replace the revoked certificates with new certificates from trusted third parties directly from PAM360. Refer to the detailed help section to learn more about certificate request and deployment using PAM360. 2. SSL End-Server Vulnerability End-server vulnerability is caused due to improper configuration of SSL protocol in your domain server. PAM360 tests your domain servers for the following end-server vulnerability. 2.1 Heartbleed Bug i. Error: The selected server is prone to Heartbleed vulnerability. ii. What's the issue? Heartbleed bug is a vulnerability in the OpenSSL, a popular open source cryptographic library that helps in the implementation of SSL and TLS protocols. This bug allows attackers to steal private keys attached to SSL certificates, usernames, passwords and other sensitive data without leaving a trace. PAM360 checks your domain servers for Heartbleed bug vulnerability and flags the affected servers. Learn more about Heartbleed bug iii. Workaround Patch your OpenSSL software. Replace the vulnerable versions with safe versions of the software. 2.2 POODLE SSL i. Error: The selected server is prone to POODLE attack. ii. What's the issue? The POODLE is a form of a man-in-the-middle attack that exploits the vulnerability in the CBC encryption scheme as implemented in the SSL 3.0 protocol. Though POODLE is not as serious as the Heatbleed vulnerability, best practices recommend you discover and mitigate the problem as quickly as possible. PAM360 scans your servers and flags servers that are vulnerable to POODLE attack. Learn more about POODLE iii. Workaround: Disable SSL 3.0 protocol and enable TLS protocols (1.0, 1.1 and 1.2) on the client-side. It's to be noted that by default, PAM360 disables SSL 3.0 protocol on the PAM360 server. 2.3 SSL 3.0 Enabled i. Error The selected server exploits the outdated SSL 3.0 protocol, which is prone to known vulnerabilities. ii. What's the issue? It has been discovered that SSL 3.0 protocol has a flaw in its design that makes it vulnerable to man-in-the-middle attacks. If you have a public facing website dealing with payments, you should immediately discover all servers that exploit SSL 3.0 and upgrade to TLS version. PAM360 scans servers in your network and flags all servers that make use of this protocol. Learn more about SSL 3.0 vulnerability iii. Workaround: Disable SSL 3.0 protocol and enable TLS protocols (1.0, 1.1 and 1.2) on the client-side. It's to be noted that by default, PAM360 disables SSL 3.0 protocol on the PAM360 server. 2.4 Weak Cipher Suites i. Error: The selected server exploits weak SSL ciphers,which is a medium risk vulnerability. ii. What's the issue? Many organizations knowingly or unknowingly exploit weak SSL protocols and cipher suites in their domain servers which makes their website vulnerable to various MITM attacks. To play safe, they have to identify those weak ciphers, disable them and re-configure the domain servers. By default, SSL 3.0 is disabled on PAM360 server, which is a weak SSL protocol. In addition, PAM360 scans the end-point servers and flags the weak ciphers used in the TLS (1.0,1.1 and 1.2) protocol. iii. Workaround: Disable weak cipher suites and re-configure your domain server. 3. Key Takeaways Here's a quick summary on how PAM360 scans your domain servers for vulnerability. PAM360 initially scans the domain servers (to which the selected SSL certificate is deployed) and flags the weak ciphers. Your domain server is scanned for HEARTBLEED and POODLE vulnerability, followed by CRL and OCSP revocation statuses. When one or more of the above vulnerability checks renders a positive result, PAM360 flags the particular certificate as vulnerable. Also, you can schedule automatic periodic vulnerability checks for your SSL certificates using PAM360 and opt an e-mail notification to the administrators as and when the tests are completed. PAM360 provides dedicated, comprehensive, periodic reports on SSL vulnerability. 4. SSL Vulnerability Scan To perform SSL vulnerability check on your domain server, follow the below steps: Navigate to Certificates >> Certificates. Click on Vulnerability icon () present to the left of the required certificate. You will be redirected to a window which displays the certificates and the list of servers in which it is deployed. Click Scan. If you want to perform the vulnerability scan on SANs also, enable Include SAN check box. If you want to perform this scan only for the servers in which the particular certificate is deployed (as discovered by PAM360), enable Only deployed servers check box. PAM360 runs the scan and displays the results in a separate window. It comprises of the following details: IP address, Port corresponding to the domain server CRL, OCSP revocation statuses POODLE SSL, HEARTBLEED vulnerability status Information on whether the current version of the certificate (version of certificate being scanned) is deployed on domain servers List of insecure ciphers in SSL 3.0 and TLS (1.0, 1.1, 1.2) protocols in the domain server Note: By default, SSL 3.0 protocol is disabled in PAM360 server for security purposes. To scan SSL 3.0 protocol on your domain servers, you have to first enable SSL 3.0 protocol on PAM360 server and then restart the server. Click Export to export the report in the form of PDF or e-mail to specific mail ids for better interpretation. To schedule automatic vulnerability scan, Navigate to Admin >> SSH/SSL >> SSL Vulnerability Enable scheduled task by selecting the Enable radio button. Choose the recurrence type and specify the time interval You can opt to receive e-mail notifications to specific email ids after every scan by enabling the Enable Report check box To enable scanning SSL 3.0 protocol in domain servers, enable the same in PAM360 server by choosing the enable option. Click Save. The scheduled task is saved and vulnerability scan is carried out as per the scheduled time interval. Notes: The above technique is used to perform vulnerability scan for all certificates in the PAM360 repository. To run the scan only for selected certificates, you can do so from the Admin >> SSH/SSL >> Schedules tab. Refer to the help section on schedules to learn how to schedule vulnerability scan for selected certificates. To view the data generated from the SSL vulnerability scans, go to the Dashboard tab >> Keys Dashboard >> Vulnerabilities widget. PAM360 generates instant, comprehensive reports on SSL Vulnerability for better interpretation, which can be accessed from Reports tab. To learn more, refer to the detailed help section on reports.