14

I noticed that, while browsing through many bug bounty and vulnerability disclosure programs, they don't accept issues that are related to TLS/SSL, which includes expired security certificates.

Why are companies so unwilling to accept expired certificates, which can easily be fixed?

3

4 Answers 4

48

Why are companies so unwilling to accept expired certificates, which can easily be fixed?

With proper certificate validation a client will not connect to a server which provides an expired certificate. This means that no data will be exchanged over the improperly secured connection. This also means that there is no actual security problem - only an availability problem.

Sure, there are clients which might ignore that the certificate is expired or users which skip browsers warnings. But in this case the real issue is improper certificate validation at the client side, not the expired certificate.

11
  • 11
    Isn't availability considered one of the pillars of security?
    – Nacht
    Mar 3, 2023 at 3:56
  • 14
    @Nacht That really depends on who you ask. All the entities I've seen refer to availability as a "pillar" of security never explain why they consider it to be one. At least from a security standpoint. If secure channels aren't functioning, lack of availability would be more secure, would it not?
    – Logarr
    Mar 3, 2023 at 4:32
  • 3
    @Logarr I think including availability is to include DoS attacks, which don't really mess with the data itself but still would be considered by most to be a security issue Mar 3, 2023 at 4:36
  • 22
    Yes, DoS attacks being the common example... Perhaps the problem is more when an attacker can compromise your availability, whereas in this case, there is no attacker, the lack of availability is fully within your control.
    – Nacht
    Mar 3, 2023 at 4:50
  • 4
    @Siguza There's a class of availability vulnerabilities that have much in common with other security issues: there's an attacker (as Nacht says) who maliciously provides some kind of input to the system that causes it to break in a harmful way. There are also availability issues that aren't particularly security-related (e.g. "what if the data center catches fire?"), but I can just as easily say there are confidentiality issues that aren't security-related ("what if a court orders us to reveal this?") and integrity issues that aren't security-related ("what if the database corrupts itself?") Mar 4, 2023 at 2:01
22

Other answers here have addressed the security side of expired certificates. I am going to address the bug bounty side of the question.

If the company's main/live domain(s) has an expired certificate; they sure know about it. Their tech support switchboard has just lit up with all these calls about an 'insecure site'.

If there is an expired cert (or even a self-signed cert) on one of their domains it is likely abandoned, or for internal use only.

Publishing a bug bounty scheme implies that the company is going to pay money for bug reports.

By being up front about excluding this sort of thing they stop low-effort scanners going over their domains and submitting bug reports. This has a dual effect of not wasting the company's time and preventing the negative publicity on social media when the person submitting the report doesn't get a payout.

Update:

As bta points out in their excellent comment, it would also be trivial to scan domains, save the current expiry date and revisit them again at that time in the hope of getting a bug report out of this.

I would also think that the restriction is merely a type of gatekeeping. If a seasoned security researcher spotted an actual problem; say a % of a company's application servers used an out of date version of - for example - OpenSSL that allowed downgrade attacks, that researcher would know enough about the situation to submit a report anyway. My guess is that such a report would be paid on, whatever the policy says.

2
  • 8
    Not to mention, the certificate has an expiration date. Writing a script that waits until a certificate's date passes and then files a bug report on it is hardly the type of investigative work that bug bounties are designed to reward.
    – bta
    Mar 4, 2023 at 1:34
  • @bta good point, well made.
    – Skrrp
    Mar 4, 2023 at 1:38
10

SSL certificate expiration is a low-effort "just in case" measure against a possible SSL private key leak which theoretically allows to perform a MiTM attack which is not a small feat at all nowadays considering things like DoT/DoH/DNSSec. Serious hostile actors can hack people while being on the same LAN as them or by hacking any intermediate Internet provider/network which many (if not most) governments can do.

So, unless a SSL private key has been leaked, there's no vulnerability at all. In all honesty if your clients can stomach the "certificate has expired" warning, it's all good and secure.

3
  • 4
    Nearly all SSL certificates are leaked. It's kind of the point ;) Mar 3, 2023 at 21:47
  • @ChristopherSchultz Source?
    – nobody
    Mar 6, 2023 at 0:04
  • An SSL/TLS certificate is just the public part of a public/private key-pair plus some additional metadata such as identity, validity dates, and signatures. The whole point of the certificate (and public key) is that is it widely distributed. It's public. If it's not available to the public (even if the definition of "the public" is pretty narrow, such as within an intranet/VPN/VLAN), then it's useless. Keeping your public keys private doesn't allow them to be used. I see that the original question has been edited at this point so my comment looks like ignorant trolling. Originally it wasn't. Mar 6, 2023 at 14:49
8

TLDR: bug bountys are to tell me something that I don't know.

Expired SSL certs are an annoyance that can be automatically detected. there is no point to pay a human operator for something that can be monitored and predicted using automated software, or even a calendar.

Revoked certs are another matter these certs may indicate an actual risk, but these are still detectable by automated means.

Nevertheless in both cases if they are not detected by IT staff they will likely be reported by users almost immediately when they cease to work, so bug bounty reports will only be duplicating something that is already known.

1
  • 1
    +1 : The Accepted Answer (which is highly upvoted) is missing the Point. The Question is not about whether it is a bug or not. The Core is about whether it should get the Bounty or not. Expired SSL Certificates are easy to Detect (even automatically) hence getting rewarded with the Bounty would be a huge waste. Likewise , reporting known bugs would not get the Bounty.
    – Prem
    Mar 5, 2023 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .