A Valid TLS Certificate Is Not the Same as a Good TLS Configuration
Why certificate validity is only one part of transport security, and why protocol configuration, compatibility and ongoing checks also matter.
What the old article was trying to correct
The 2015 JufCorp article challenged a common assumption: installing a trusted certificate does not complete the TLS/security job. It discussed then-current protocol and cipher weaknesses on IIS/Exchange and warned that changing transport settings can affect client compatibility.
Separate certificate checks from server configuration
Certificate identity, names, issuer and expiry answer one set of questions. The server's accepted transport configuration answers another. A clean certificate result should therefore not be treated as a complete transport-security verdict.
Compatibility is part of a real change
The source specifically warns that tightening TLS settings can break applications and clients if the environment is not tested. The durable lesson is to inventory dependencies, stage changes and verify the real clients that use the service.
Recheck after changes and over time
Transport posture can change with server updates, certificates and configuration. External checks are useful because they show what a client actually sees from outside rather than only what an administrator believes is configured.
How this maps to Scantide
Scantide Online and Web Monitor fit the modern version of this old idea: observe public certificate and HTTPS/TLS evidence, track expiry and configuration signals, and treat the result as evidence to investigate rather than a magical security grade.
Questions that usually come next
Is HTTPS enough to say a site is secure?
No. The source explicitly argues that a valid certificate and encrypted connection are only part of the security picture.
Why not copy the old TLS settings directly?
Because the article is from 2015 and protocol/client requirements change. The modern guide preserves the principle, not the old configuration recipe.
Use the evidence, then choose the tool
Scantide Guides explains the problem. Use Online for outside-in public evidence, Auditor for authorized internal visibility, Observe for browser-visible behavior and Guard for active server protection.
All Scantide GuidesScantide ProductsPractical depth: examples, failure modes and what to verify
Field experience from the archive
The problem is that there's actually no real way for the connecting computer to validate that the site it is connecting to actually is the site it's hoping for. It might as well be someone claiming to be that site since the certificate used can't be validated by a third party (the "Trustad Authorities"). This way , phishing attacks ("phising" is when you "phish" for a users valid credentials to use them later at the users real websites)
It's absolutely no guarantee even if you do use a valid certificate since also the "Trusted Authorities" can be hacked and therefore all of their certificates can be compromised (yes, it's already happened a few time in the past year, GoDaddy, Verisign and even Microsoft themselves realized they had a bug in how Windows Update actually validates that it is connecting to the Windows Update site and nowhere else.)
Have a look at Letsencrypt for most of your SSL certificate needs. It's free (yay!) , works fine and is supported by most and it's even your CEO's favorite price tag.
Yep. Not that much fun no. It's more fun to get stuff up and running and move on to the next task isn't it? Still, having a good documentation about what the server does, how it's connected to other server and systems (ie dependencies) and the baseline configuration of it will make your life much easier. Depending on the size of your environment , Spiceworks might be a good place to start
Whatever you'll be using your server for. have a look at any information that it "bleeds". This could for instance be headers telling any attacker exactly what version of software you're running. If possible, try to hide such information. There's no need for it to be visible and help a hacker find a way in. Simple checks using telnet to the ports your services might reveal some interesting information . Sadly, it's not possible to remove all headers etc but you should give it a go and remove as many as possible While on the subject, use SSL-certificates for any service where possible. Also make sure to set it up correctly (disable weak ciphers, enable HSTS, set correct HTTP headers, set TLS correctly etc ) . Have a look at Letsencrypt for instance for SSL certificates. It's free, supported by basically everyone and it'll probably get the job done for you . All you have to remember is to check that your certificates are renewed every three months.
This automated scanner focuses on infrastructure vulnerabilities, exposed services, and configuration issues. However, many critical security threats require manual testing, code review, or specialized tools. Ensure your security strategy addresses the following areas:
Practical review checklist
- The problem is that there's actually no real way for the connecting computer to validate that the site it is connecting to actually is the site it's hoping for.
- This automated scanner focuses on infrastructure vulnerabilities, exposed services, and configuration issues.
- Have a look at Letsencrypt for most of your SSL certificate needs.