Kingdom: Environment

This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.

Web Server Misconfiguration: Deprecated SSL/TLS Certificate

Universal

Abstract

Use of a deprecated SSL/TLS certificate on the target server can compromise the privacy and integrity of user data on the communication channel.

Explanation

All SSL/TLS certificates issued before December 1, 2017 from the Symantec infrastructure are deprecated and are no longer trusted by major browsers including Chrome, Firefox, Safari, Internet Explorer, and Edge. This includes all certificates issued by Symantec and its affiliated subsidiary CA's: Thawte, GeoTrust, Equifax, Verisign, and RapidSSL.
Symantec CA public key infrastructure was acquired by DigiCert in October 2017. Starting December 1, 2017, DigiCert took over the validation and issuance of all Symantec SSL/TLS certificates. These new and reissued certificates that use DigiCert as the root CA are trusted by all browsers.
Deprecated certificates imply that the certificate fails to protect the privacy and integrity of user data on the SSL/TLS communication channel. Customers who access websites that use deprecated certificates receive a "Your connection is not private" warning to deter them from continuing to the website.

References

[1] Reissue Certificates before Distrust Deadlines

[2] Distrust of the Symantec PKI: Immediate action needed by site operators

[3] Standards Mapping - Common Weakness Enumeration CWE ID 298

[4] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287, [25] CWE ID 295

[5] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287

[6] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287

[7] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287

[8] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287

[9] Standards Mapping - Common Weakness Enumeration Top 25 2024 [14] CWE ID 287

[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000185, CCI-001941, CCI-001942

[11] Standards Mapping - FIPS200 CM

[12] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[13] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-2 Identification and Authentication (Organizational Users) (P1), IA-5 Authenticator Management (P1), SC-17 Public Key Infrastructure Certificates (P1)

[14] Standards Mapping - NIST Special Publication 800-53 Revision 5 IA-2 Identification and Authentication (Organizational Users), IA-5 Authenticator Management, SC-17 Public Key Infrastructure Certificates

[15] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[16] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 6.2.1 Algorithms (L1 L2 L3), 9.2.1 Server Communications Security Requirements (L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)

[17] Standards Mapping - OWASP Mobile 2014 M3 Insufficient Transport Layer Protection

[18] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[19] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[20] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[21] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[22] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[23] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.9

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.9

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 4.2.1

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 6.2 - Sensitive Data Protection

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 6.2 - Sensitive Data Protection

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 6.2 - Sensitive Data Protection, Control Objective C.4.1 - Web Software Communications

[36] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3290.2 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-001810 CAT I

[53] Standards Mapping - Web Application Security Consortium Version 2.00 Server Misconfiguration (WASC-14)

[54] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.dynamic.xtended_preview.web_server_misconfiguration_deprecated_ssl_tls_certificate