No SSL

ALTERNATIVE NAMES

TLS or SSL Service not installed

AFFECTED SYSTEMS

Web, mail and other HTTP services

SEVERITY

Critical

BACKGROUND

HTTP Protocol is currently only used for redirecting clear text communication to HTTPS protocol. In the early days, HTTP protocol was widely used but it was insecure since the transmitted data was in cleartext. Nowadays, there could be tens of hops between the client and the server and clear text data could be sniffed in each of these transmission hops. This can be a government controlling the backbone to a hacker who is connected to the same wireless network.

DESCRIPTION

Any person connected to the same network or in any man in the middle attack could reveal all transmission between the client and the server. Valuable information including private data such as credit card numbers, other private data, and even authentication credentials could be gathered.

ANALYSIS

In normal circumstances, HTTP protocol is only used to redirect HTTP traffic to HTTPS traffic. If the site is only serving with HTTP protocol, any transmission passing through the network can be collected including credit card numbers, authentication credentials, etc. SSL protocol consists of a private key and a public key pair. The public key must be stored in a secure environment like an HSM or must be protected with a password. If the public key is stored with a password, each time the server restarts, the password must be entered from the console to activate the HTTPS protocol. In most cases, the private key is stored on the server without a password. In any case, it is better than not to have an SSL protocol.

When SSL is enabled on the server, a direct call to the HTTPS can be made but older browsers may first test for HTTP protocol. The redirection to HTTPS protocol must be handled by the server administrator. Please refer to the HTTPS redirection article to enable HTTPS redirection. After the SSL negotiation on the ciphers available on both sides finishes, the server sends the public key to the client, from this point any data encrypted with the public key could only be decrypted with the private key located on the server.

SOLUTION

SSL/TLS service must be activated on the default port 443. You may check our guidelines on installing a secure server based on your server type. Please follow the steps to have a secure connection from your server:

Obtain an SSL certificate: A DV(domain validated) certificate of your choice can be purchased online via several SSL Certificate Providers or you can have a free certificate from letsencrypt.org, also with EV (Extended Validation) certificates your site URL will be highlighted with a green lock on the browser. Approved certificate providers Certificate Authority (CA) certificates are installed on every client device with the OS, any certificate generated by the Certificate Authorities will be treated as trusted by most of the client browsers, before having a certificate file, make sure it is compatible with the most used browsers. In order to apply for a signed certificate, you have to create the private key (which must be kept on your side) and a Certificate Signing Request (CSR) that will be sent to the issuer. The issuer will send you the signed certificate and/or other intermediate certificates with an email or from their GUI.

To generate your pair on Linux Systems you should have OpenSSL libraries installed

On Apache Servers:

yum install mod_ssl openssl

Create a folder to keep SSL files

mkdir /etc/httpd/ssl
cd /etc/httpd/ssl

Generate key pair

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

Fill the form appropriate to your domain, make sure you use the correct domain and decide whether you want to use www. or not. Please note that if you use a password (you can leave blank) you have to enter the password every time you restart your web server.

Send the CSR file generated to the certificate issuer. Install the certificate with our guidelines based on your server choice.  Recheck Onlayer to check if your installation is succeeded.