Ssl Tls Certificate Weak Signature Md5
Description
This detector identifies SSL/TLS certificates that use the weak MD5 hash algorithm for digital signatures. MD5 is cryptographically broken and vulnerable to collision attacks, making certificates signed with MD5 unsuitable for secure communications and potentially allowing attackers to forge certificates.
Detection Strategy
• Establishes an SSL/TLS connection to the target server
• Retrieves the server's X.509 certificate
• Examines the signature hash algorithm used to sign the certificate
• Reports a vulnerability when the certificate is signed using the MD5 hash algorithm
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.