Auditing TLS configuration
You understand the TLS handshake, versions, cipher suites and forward secrecy; you audit servers with openssl s_client, testssl.sh and Nmap, harden Nginx, Apache and non-web services to the company TLS policy and audit them again.
Level 201 · 18 lessons · 18 practice labs
Lessons
Understanding TLS
- The TLS handshake step by step
- TLS versions: why 1.0 and 1.1 must be switched off
- Reading cipher suites
- Forward secrecy and key exchange
- Short task: mark up a handshake step by step in Wireshark
Auditing
- Querying a server with openssl s_client
- A thorough audit with testssl.sh
- Listing cipher suites with Nmap
- Certificate checks: chain, name match, key size, expiry
- Recognising and closing known TLS weaknesses
- Short task: audit and grade the TLS configuration of three lab servers
Hardening
- Secure TLS settings for Nginx and Apache
- HSTS and redirecting to HTTPS
- OCSP stapling
- TLS beyond the web: mail, databases, LDAP
- Short task: bring a server up to the company TLS policy and audit it again
Policy
- Writing a company TLS policy
- Capstone: audit, fix and report every TLS endpoint of an organisation
Practice labs
- Mark the TLS handshake steps in a capture: Find each handshake message of a connection in the lab capture in order and record what each one carries.
- Compare TLS 1.2 and 1.3 handshakes: Connect to the same lab server with both versions, inspect the capture in Wireshark and report the difference in round trips and encrypted parts.
- Find connections without forward secrecy: Extract the key exchange type of the connections in the lab capture, identify servers without forward secrecy and write a fix recommendation.
- Query a server with openssl s_client: Connect to the lab web server, extract version, cipher suite and the served chain, and write a short finding note.
- List cipher suites and flag the weak ones: List the cipher suites supported by two lab servers with the Nmap script and flag those against company policy.
- Audit and score the TLS setup of three lab servers: Scan Turnalı Perakende's three servers with a full TLS audit tool, rank them on a common scale and write the priority list.
- Audit certificate key size and signature algorithm: Extract key size and signature algorithm from the lab servers' certificates and report the one below policy.
- Find the missing intermediate and fix the chain: Detect the missing intermediate on the lab server that fails for some clients, fix the chain and verify with different clients.
- Review a server certificate for chain, name, lifetime and key: Review the certificate on Mercanköşk Otelcilik's booking server from four angles, write findings by severity, install a new one and retest.
- Turn off TLS 1.0 and 1.1 and verify: Show the old versions are enabled on the lab server, disable them and prove a connection with an old version is refused.
- Clean up weak cipher suites: Remove RC4, 3DES and weak key-exchange suites from the lab server, repeat the audit and record the before-and-after list.
- Find, close and retest known TLS weaknesses: Close the renegotiation, compression and weak DH parameter findings on the lab server and add a retest result for each to the report.
- Apply secure TLS settings to Nginx: Apply the version and cipher suite settings from company policy to the lab Nginx server, test the configuration and rerun the audit.
- Add HSTS and an HTTPS redirect and verify them: Add a permanent HTTP-to-HTTPS redirect and an HSTS header to the lab site, test the effect on subdomains and record it.
- Bring Apache to policy and enable OCSP stapling: Bring Kuzeyyıldızı Kargo's lab Apache server in line with policy, turn on OCSP stapling and verify the response arrives in the handshake.
- Audit the mail server's TLS settings: Audit STARTTLS support, the certificate and versions on the lab mail server and write the gaps as findings.
- Require TLS on database and LDAP connections: Turn off unencrypted connections on the lab database and directory service, and show clients verify the certificate while plain connections are refused.
- Audit, fix and report on all of a company's TLS endpoints: Find every TLS endpoint in Sedirli Hukuk Bürosu's lab network, write the company TLS policy, bring the endpoints into line and deliver the report.
About this course
You understand the TLS handshake, versions, cipher suites and forward secrecy; you audit servers with openssl s_client, testssl.sh and Nmap, harden Nginx, Apache and non-web services to the company TLS policy and audit them again.
What you will learn
- Understanding TLS
- Auditing
- Hardening
- Policy
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.