zakirkun Insecure TLS Configuration
Overview
TLS misconfigurations expose communications to interception and tampering:
- InsecureSkipVerify: Disables certificate validation entirely — trivial MITM
- TLS 1.0/1.1: Deprecated protocols with known weaknesses (BEAST, POODLE)
- Weak cipher suites: RC4, DES, 3DES, EXPORT ciphers
- Self-signed cert acceptance:
verify=Falsein Python requests
Remediation
- Never set
InsecureSkipVerify: truein production - Enforce TLS 1.2 minimum (TLS 1.3 preferred)
- Use only AEAD cipher suites (AES-GCM, ChaCha20-Poly1305)
- Always verify certificates in HTTP clients
Vulnerable (Go):
tr := &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}
Safe (Go):
tr := &http.Transport{
TLSClientConfig: &tls.Config{
MinVersion: tls.VersionTLS13,
},
}