PRC105 — The API's TLS is weak

What it catches

When the target is https, procyon test connects with Go's crypto/tls and reports, in one finding about the whole API:

• a protocol older than TLS 1.2 accepted (TLS 1.0, TLS 1.1), offering every suite Go has, legacy ones included, since a server stuck on an old protocol usually speaks only those;
• a weak cipher suite accepted (Go's list of insecure suites: RC4, 3DES, RSA key exchange, CBC with SHA-256, …);
• for a certificate a known CA signed: expired, not valid yet, or for another host name.

A self-signed or private-CA certificate is accepted and its name and dates are not judged: anyone can mint one with any name and dates, and a disposable copy rarely has a public one. The check runs first, so a server that speaks only an old protocol is reported and the run goes on. A handshake that fails entirely is a note. A plain http target is not checked; a note says so, since the TLS of a copy on loopback usually belongs to the production proxy instead.

Why it matters

A client that can be talked into TLS 1.0 or a weak suite talks on a connection an attacker on the network can read or tamper with, and an expired or wrong certificate teaches clients to click through warnings.

How to fix it

Accept TLS 1.2 and 1.3 only, with modern cipher suites (Go, nginx and most proxies do by default; check old configuration), and serve a current certificate for the API's host name.

How to ignore it

The finding is about the API as a whole, so the ignore goes at the spec's root. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

x-procyon-ignore:
  - rule: PRC105
    reason: "The staging copy uses an internal CA certificate for another name"

Known limits

• Go cannot offer SSLv3 or DHE suites, so a server that accepts only those is not seen (it fails every modern client anyway).
• Under GODEBUG=fips140=only the old protocols and weak suites cannot be offered, so nothing is found.

Examples

Reported:

TLS 127.0.0.1:8443    negotiated TLS 1.0

Not reported: a server that refuses TLS 1.0 and 1.1 and the weak suites, with a current certificate for the host (self-signed is fine).