Certificate revocation is the act of invalidating a TLS/SSL before its scheduled expiration date. A certificate should be revoked immediately when its private key shows signs of being compromised. It should also be revoked when the domain for which it was issued is no longer operational.
id: revoked-ssl-certificate
info:
name: Revoked SSL Certificate - Detect
author: pussycat0x
severity: low
description: |
Certificate revocation is the act of invalidating a TLS/SSL before its scheduled expiration date. A certificate should be revoked immediately when its private key shows signs of being compromised. It should also be revoked when the domain for which it was issued is no longer operational.
reference:
- https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/revoked-ssl-certificate/
- https://www.tenable.com/plugins/nnm/5837
metadata:
max-request: 1
tags: ssl,tls,revoked,vuln
ssl:
- address: "{{Host}}:{{Port}}"
matchers-condition: and
matchers:
- type: dsl
dsl:
- "revoked == true"
- type: dsl
dsl:
- "expired == true"
negative: true
# digest: 4a0a0047304502206d1341c71a08fe25dbcbf4527b57a7de00fff11b2bffc42d0fbcb2c4a91fa7ef022100bc742b72b1621451696a673589c1c775be01a9d9954e100c058aee8411b5863e:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.