<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-ssl-tls-audit-templates
description: >-
  Write Nuclei templates for auditing SSL/TLS configurations including
  weak cipher suites, expired certificates, protocol downgrade attacks,
  missing HSTS headers, certificate transparency issues, and common
  TLS misconfiguration patterns.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - ssl
  - tls
  - certificates
  - encryption
  - audit
  - templates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557.002"]
---

# Writing SSL/TLS Audit Templates

## Overview

SSL/TLS audit templates detect encryption weaknesses including outdated
protocols, weak cipher suites, certificate problems, and missing security
headers. These templates combine Nuclei's SSL protocol support with HTTP
header analysis to provide comprehensive transport layer security assessment.

Mode: `[MODE: BLUE]` — Transport layer security audit and hardening validation.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Understanding of TLS protocol versions and cipher suites | Required |
| HTTPS-enabled targets for testing | Required |

## Key Concepts

### SSL Certificate Expiry Detection

```yaml
id: ssl-certificate-expiry

info:
  name: SSL Certificate Expiry Detection
  author: nerf
  severity: high
  description: |
    Detects SSL certificates that are expired or expiring within
    30 days. Expired certificates cause browser warnings and may
    indicate abandoned or poorly maintained infrastructure.
  tags: ssl,certificate,expiry,misconfig
  metadata:
    max-request: 1

ssl:
  - address: "{{Host}}:{{Port}}"
    matchers:
      - type: dsl
        dsl:
          - 'not_after < now + duration("720h")'
    extractors:
      - type: dsl
        dsl:
          - 'not_after'
          - 'subject_cn'
          - 'issuer_cn'
```

### Weak TLS Protocol Detection

```yaml
id: weak-tls-protocol-detection

info:
  name: Weak TLS Protocol Version Detection
  author: nerf
  severity: medium
  description: |
    Detects servers supporting deprecated TLS protocol versions
    including TLS 1.0 and TLS 1.1, which have known weaknesses
    and are no longer considered secure for data in transit.
  reference:
    - https://datatracker.ietf.org/doc/html/rfc8996
  classification:
    cwe-id: CWE-326
  tags: ssl,tls,protocol,weak,misconfig
  metadata:
    max-request: 1

ssl:
  - address: "{{Host}}:{{Port}}"
    min_version: tls10
    max_version: tls11
    matchers:
      - type: dsl
        dsl:
          - 'tls_version == "tls10" || tls_version == "tls11"'
    extractors:
      - type: dsl
        dsl:
          - 'tls_version'
          - 'cipher'
```

### Missing HSTS Header Detection

```yaml
id: missing-hsts-header

info:
  name: Missing HTTP Strict Transport Security
  author: nerf
  severity: medium
  description: |
    Detects HTTPS sites missing the Strict-Transport-Security header.
    Without HSTS, users are vulnerable to SSL stripping attacks that
    downgrade connections from HTTPS to HTTP.
  classification:
    cwe-id: CWE-319
  tags: ssl,hsts,header,misconfig
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - '!contains(tolower(all_headers), "strict-transport-security")'
      - type: dsl
        dsl:
          - 'contains(protocol, "https")'
      - type: status
        status:
          - 200
          - 301
          - 302
```

### Self-Signed Certificate Detection

```yaml
id: self-signed-certificate

info:
  name: Self-Signed SSL Certificate Detection
  author: nerf
  severity: medium
  description: |
    Detects self-signed SSL certificates that are not trusted by
    standard certificate authorities. Self-signed certificates
    indicate test environments, internal services exposed externally,
    or potential man-in-the-middle interception.
  classification:
    cwe-id: CWE-295
  tags: ssl,certificate,self-signed,misconfig
  metadata:
    max-request: 1

ssl:
  - address: "{{Host}}:{{Port}}"
    matchers:
      - type: dsl
        dsl:
          - 'subject_cn == issuer_cn'
          - 'self_signed == true'
        condition: or
    extractors:
      - type: dsl
        dsl:
          - 'subject_cn'
          - 'issuer_cn'
          - 'not_after'
```

### Wildcard Certificate Scope Detection

```yaml
id: wildcard-certificate-detection

info:
  name: Wildcard SSL Certificate Detection
  author: nerf
  severity: info
  description: |
    Detects wildcard SSL certificates which may indicate shared
    hosting infrastructure or overly broad certificate scope.
    Wildcard certs cover all subdomains and increase blast radius
    if the private key is compromised.
  tags: ssl,certificate,wildcard,recon
  metadata:
    max-request: 1

ssl:
  - address: "{{Host}}:{{Port}}"
    matchers:
      - type: dsl
        dsl:
          - 'contains(subject_cn, "*.")'
    extractors:
      - type: dsl
        dsl:
          - 'subject_cn'
          - 'subject_an'
          - 'issuer_org'
```

## Workflow

### Step 1: Validate Template

```bash
nuclei -t ssl-audit.yaml -validate
```

### Step 2: Run SSL Audit

```bash
node scripts/agent.js --action scan --target https://example.com \
  --template ssl-audit.yaml --output /tmp/ssl-audit.json
```

### Step 3: Bulk SSL Assessment

```bash
node scripts/agent.js --action scan --target-list https-hosts.txt \
  --template ssl-templates/ --output /tmp/ssl-bulk.json
```

## Verification

- [ ] SSL templates use `ssl:` protocol block with `address` field
- [ ] Certificate expiry uses `not_after` DSL comparison
- [ ] TLS version detection uses `min_version` and `max_version`
- [ ] HTTP templates check for HTTPS-only headers (HSTS)
- [ ] Self-signed detection compares subject and issuer
- [ ] Extractors surface certificate details for reporting
- [ ] `max-request` metadata matches actual request count

## References

- [Nuclei SSL Protocol](https://docs.projectdiscovery.io/templates/protocols/ssl)
- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)
- [NIST SP 800-52r2 — TLS Guidelines](https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final)
- [RFC 8996 — Deprecating TLS 1.0 and 1.1](https://datatracker.ietf.org/doc/html/rfc8996)
