Security Performance Management
Continuous Monitoring
Cyber Insurance
National Cybersecurity

Articles in this section

See more

TLS/SSL Configuration Finding Considerations

Avatar
Ingrid
Follow
  • August 8, 2022: Clarification on domain and IP differences.
  • February 24, 2020: Published.

TLS/SSL Configuration findings are based on a Host:Port or IP:Port pair.

  • If an IP is part of a company’s infrastructure, IP-based findings are attributed to them.
  • For websites hosted on Content Delivery Networks (CDN), only domain-based findings are attributed.
  • If both IP and domain are within a company infrastructure, two separate findings are assigned to the same company (e.g., moving from a self-hosted website to a service provider-hosted website), ensuring the finding information is consistent even if a domain’s destination IP changes.

Findings that are based on domains (rather than IP) and are part of a service provider’s infrastructure are graded and are weighted the same as owned infrastructure. Learn more about Shared Responsibility with Cloud Service Providers.

These considerations ensure:

  • The remediation of a misconfigured TLS/SSL record immediately takes effect upon a rescan. The exclusion of IP addresses from the evidence key prevents the duplication of records in situations where the IP addresses are dynamic (CDN).
  • TLS/SSL Configurations observed on service providers for IP-based scans are not graded.
  • TLS/SSL Configuration records are not attributed based on certificate subject names.

A record is included in a company’s report if either of the following is true:

  • It is a host-based scan and the hostname belongs to the company.
  • It is on an IP address that belongs to the company.

TLS/SSL Configuration findings are handled in the following manner:

Scan Type Description
IP
  • Company-Owned IP Addresses: Findings on these IPs immediately replace all previous findings. The new findings become the current, impacting record findings; previous findings are classified as duplicates and no longer impact the letter grade.
  • Service Provider-Owned IP Addresses: No TLS/SSL Configurations findings that are part of a service provider’s infrastructure are recorded. Previously recorded findings immediately stop impacting the letter grade and are removed.
Hostname Service Provider-Hosted Domains: Findings where the hostnames belong to a company, but are part of a service provider’s infrastructure, are graded and weighted the same as company-owned TLS/SSL Configurations findings (as if it were part of the company’s infrastructure).

Only service provider records with hostnames are displayed in the Bitsight platform, identified by the (†) dagger symbol.

Related articles