How to resolve SSL Certificate Cannot Be Trusted

Question

I am running a vulnerability scan on my Windows host using Tenable, and it has detected a vulnerability called "SSL Certificate Cannot Be Trusted." How can I fix it?

Answer 1

It reports on these ports/certs.

Port 8640 CN=127.0.0.1 (Localhost)

Port 8834 Nessus Server (Tenable Nessus!)

Port 9527 Hikvision CN=127.0.0.1 (Localhost, security camera?)

It looks like you are running the scanner software against the machine that hosts the software. That is not a valid network scan. The Windows firewall will not block access to localhost, 127.0.0.1.

I do not have any experience with Tenable but it appears that it's function is to scan your network to see what machines have open, vulnerable, ports exposed to the network. You should install the Tenable software on a machine whose sole purpose is to scan the other machines on your network.

You can test to see if those ports are exposed to the network by running Powershell from another PC.

Test-NetConnection -ComputerName YourPCname -port 8640 
Test-NetConnection -ComputerName YourPCname -port 8834 
Test-NetConnection -ComputerName YourPCname -port 9527 

Even if the ports are open, then that is not necessarily a vulnerability. If you have a test web site defined to IIS on port 8640, well, so what? At least it has a self signed certificate.

If you have camera security software installed and it offers a user interface on port 9527, that is not necessarily a vulnerability. If the ports are open and you don't want that software accessed by other machines on your network, then you can run "wf.msc" and modify the rules in the firewall to block access.

Answer 2

Hello,

Here are some troubleshooting steps:

1. Check the Certificate:

Confirm that the SSL certificate used is issued by a trusted Certificate Authority (CA).

If it's a self-signed certificate, consider replacing it with one issued by a trusted CA.

2. Update the chain of trust:

Ensure that all necessary intermediate certificates are installed on the server to form a complete chain of trust.

3. Configure the server:

Check the SSL/TLS configuration of the server to ensure that the certificate and private key are configured correctly.

Test your SSL configuration with a tool such as SSL Labs to ensure it complies with best practices.

4. Update the client trust store:

If the client application is using an untrusted certificate, consider adding the certificate to its trust store.

5. Monitoring and Maintenance:

Regularly check and renew your SSL certificate to ensure it doesn't expire.

Monitor SSL configurations to ensure compliance with the latest security standards.

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

This can be due to

If your SSL certificate expired

If you are using a self-signed certificate

If there is any misconfiguration in your SSL/TLS

If something is missing in your certificate chain

You can check your SSL status to find out the cause and fix it as needed.