SSL/TLS Misconfigurations and How to Fix Them
HTTPS is standard now, but "has a padlock" does not mean "configured well." TLS misconfigurations can allow downgrade attacks, interception or simply broken trust when certificates expire.
Outdated protocol versions
SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are deprecated and have known weaknesses. Modern browsers no longer support TLS 1.0 and 1.1.
Recommended: support TLS 1.2 and TLS 1.3 only.
Weak cipher suites
Old ciphers using RC4, 3DES, export-grade keys, or key exchange without forward secrecy should be disabled.
Recommended: use your platform's modern or intermediate configuration profile, such as those published by Mozilla, which favours AEAD ciphers like AES-GCM and ChaCha20-Poly1305 with ECDHE key exchange.
Certificate problems
- Expired certificates, often on secondary subdomains that are not monitored.
- Hostname mismatch, where the certificate does not cover the domain served.
- Incomplete chains, missing intermediate certificates, which break some clients.
- Self-signed certificates on public services.
- Weak keys, such as RSA keys below 2048 bits.
Fix: automate issuance and renewal, for example with ACME, and monitor expiry across all hostnames.
Missing HSTS
Without HTTP Strict Transport Security, a user's first request may go over HTTP, allowing interception and downgrade.
Strict-Transport-Security: max-age=31536000; includeSubDomainsHTTP still serving content
Sites that serve full content over HTTP, instead of redirecting to HTTPS, expose users and cookies. Redirect all HTTP traffic to HTTPS, and for APIs, consider rejecting HTTP entirely.
Mixed content
HTTPS pages loading scripts, styles or images over HTTP. Browsers block active mixed content, but it signals misconfiguration and can break pages. Use upgrade-insecure-requests in your Content Security Policy as a safety net.
Insecure cookies
Session cookies without the Secure flag may be sent over HTTP.
TLS on non-web services
Mail servers, databases, message brokers and admin interfaces also need TLS. These are frequently overlooked.
Internal and service-to-service traffic
Traffic between services inside your network or cloud should also be encrypted, especially when it crosses networks or carries sensitive data.
Recommended baseline
| Setting | Recommendation |
|---|---|
| Protocols | TLS 1.2 and 1.3 only |
| Ciphers | Modern AEAD with forward secrecy |
| Certificates | Automated renewal, 2048-bit RSA or ECDSA |
| HSTS | Enabled with long max-age |
| HTTP | Redirect to HTTPS |
| Cookies | Secure flag on all sensitive cookies |
Checking every host
A main site with a perfect configuration often sits alongside subdomains with expired certificates or TLS 1.0. SecurityInfinity checks TLS configuration on every discovered host and service, not just your homepage. Start free.
Frequently asked questions
Is TLS 1.2 still secure?
Yes, with modern cipher suites. TLS 1.3 is preferred where supported, but TLS 1.2 remains widely used and acceptable.
What is forward secrecy?
A property where compromise of a server's long-term key does not allow decryption of past sessions, achieved with ephemeral key exchange like ECDHE.
Do I need an EV certificate?
No. Browsers no longer show extended validation prominently, and domain-validated certificates provide the same encryption.