3

I am running testssl scan on an http port, after running the scan I got some errors highlighted in red. The main one that I noticed is that certificate does not have SAN.

testlssl output: subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining Trust (hostname) certificate does not match supplied URI (same w/o SNI)

I tried to read the certificate and indeed it does not have SAN, but it has CN name. Is this considered as a security risk ?

Improve this question

2 Answers 2

Reset to default
4

It's not a security risk, but using the Common Name for the hostname has been deprecated for almost 25 years according to RFC 2818 (HTTP over TLS) and completely removed from modern browsers.

In other words, the certificate won't be accepted, and whatever CA issued it seriously needs an update.

Improve this answer
1

Some browsers (see discussion in this question) such as Firefox and Chrome will ignore the CN and only look at the SAN - so they will always treat a certificate with a missing SAN as untrusted.

So if your users are accessing the site with those browsers then they would always receive a certificate warning - which would look very similar to the warning they'd get if someone was presenting a spoofed certificate as part of a MitM attack or similar.

Improve this answer
4
  • 1
    in chrome, I dont just get a warning, the website does not even open. is that behavior expected ?
    – anonymous
    Commented Sep 5 at 14:30
  • @anonymous it used to give the usual certificate error page with net::ERR_CERT_COMMON_NAME_INVALID - but I don't know if that behaviour has changed.
    – Gh0stFish
    Commented Sep 5 at 14:44
  • no I am getting this error on chrome: There was a problem using your login certificate. Try contacting the system admin. ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED
    – anonymous
    Commented Sep 6 at 9:34
  • wierd thing, on chromium browser embedded in burpsuite, the website opens normally after I import the certificate of the client.
    – anonymous
    Commented Sep 6 at 9:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .