[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How to Resolve SSL Configuration Risks](/blog/ssl-configuration) Publish date January 16, 2025 {x} minute read # How to Resolve SSL Configuration Risks [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/top-security-misconfigurations-causing-data-breaches) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by Table of contents eBook Top Security Misconfigurations Causing Data Breaches Free resource ### Top Security Misconfigurations Causing Data Breaches [Download now](/resources/top-security-misconfigurations-causing-data-breaches) Transport Layer Security (TLS) provides security for internet communications. TLS is the successor to the now-deprecated Secure Sockets Layer (SSL), but it is common for TLS and SSL to be used as synonyms for the current cryptographic protocols that encrypt digital communications through public key infrastructure (PKI). To ensure that websites offer this level of communications security, web administrators generate [SSL certificates](https://www.upguard.com/blog/ssl-certificate) that use the [Hypertext Transfer Protocol Secure (HTTPS)](https://www.upguard.com/blog/what-is-https) to authenticate communications between the client and the server. To avoid vulnerabilities that result from security misconfiguration, keep your SSL certificates up-to-date and maintain a secure protection using the SSL protocol on your web server. ## Common SSL Misconfiguration Findings Without proper configuration for SSL/TLS certificates, traffic to the site may be at risk of interception by malicious actors. An untrusted or misconfigured SSL certificate puts communication at risk, whereas a revoked certificate could render the site inaccessible to most browsers. A secure connection to web applications in production environments requires application security features like SSL/TLS authentication. UpGuard scans for common issues around certificate configuration so that UpGuard users remain notified of any risks that may impact their business, such as the following SSL security configuration risks: * **Hostname does not match SSL certificate** * **SSL certificate chain missing from server response** * **Revoked certificate in use** When you generate a certificate for your site, it will include the preferred hostname or domain for the system that is being protected with encryption. This inclusion provides the necessary information to verify the connection between the client and server. If the **Hostname does not match SSL certificate**, then users will receive a browser error. In addition to sites being rendered inaccessible by this finding, mismatched certificates allow the possibility for [man-in-the-middle (MITM) attacks](https://www.upguard.com/blog/man-in-the-middle-attack). Each certificate belongs to a certificate chain that authenticates at multiple levels. Every certificate in the chain needs to be maintained accurately and remain up-to-date for the SSL validation to function as needed. The root certificate validates the certificate authority that issues the cert, with additional intermediate certificates dependent on the structure of your site structure. If you receive notice for the **SSL certificate chain missing from server response** finding, then a gap in your certificate chain will invalidate the entire chain. Certificates may be revoked by the certificate authority prior to their expiry date, in which case you would receive notification for a **Revoked certificate in use**. Revoked certificates do not provide proper SSL/TLS protection, and domains with a revoked certificate will not feature HTTPS protection. Revocation typically occurs due to a compromised private key, a decommissioned domain, or malicious behaviors like phishing or malware that originate with the domain in question. UpGuard also scans your assets for risks related to [weak SSL](https://www.upguard.com/blog/weak-ssl), [SSL certificate expiration](https://www.upguard.com/blog/what-is-ssl-certificate-expiration), [SSL/TLS availability](https://www.upguard.com/blog/what-is-the-ssl-not-available-risk), [HTTPS redirection](https://www.upguard.com/blog/https-redirection), and [HTTPS Strict Transport Policy (HSTS)](https://www.upguard.com/blog/hsts-risks). ### How UpGuard Can Help With continuous monitoring for your external attack surface, [UpGuard Breach Risk](https://www.upguard.com/product/breachsight) scans for threat signals and common issues around SSL/TLS certificates. Current UpGuard users with the Breach Risk feature can [log in and access their Risk Profile](https://cyber-risk.upguard.com/risk_profile) to search for SSL risks among their assets. If you're not a current UpGuard user and you want to run an automated scan of your assets with Breach Risk, [sign up for a trial](https://www.upguard.com/demo). Breach Risk provides automation for your security settings audit. When you have identified an SSL configuration issue for your assets, you can set up security measures to remedy the issue so that users remain protected when accessing your website. ## How to Resolve SSL Configuration Issues Each of these configuration issues can be remedied by requesting a new SSL certificate from your certificate authority. Though the certificate authorities may require different information, the process typically follows these four steps: 1. Generate a certificate signing request with your choice of certificate authority. 2. Complete the domain control validation process. 3. Activate the certificate and install it on your servers. 4. Repeat the process for all certificates in your certificate chain. As you submit a new certificate signing request for your updated SSL certificate, ensure that it has the appropriate parameters to mitigate the configuration finding and prevent misconfiguration attacks. ### Update the Hostname If your SSL finding relates to the hostname, request a new certificate with the correct hostname(s) listed on it. A properly scoped certificate will prevent browser errors and reduce certificate complexity. Review all existing certificates to ensure that each one has the proper hostname. As you update your SSL certificate renewal processes, include steps that account for any changes to hostnames or aliases. ### Protect the Certificate Chain Because the chain functions as a whole, every certificate in the chain must be valid for the end certificate facing the client server to be valid. If part of the chain is missing or invalid, then users will encounter browser errors. To remedy this finding, configure your server so the entire certificate chain is available on the system while protecting sensitive information in the root certificate, which will ensure there are no gaps between the end certificate and the root authority. ### Fix SSL Certificate Revocation If an SSL certificate is revoked, the TLS encryption is canceled and HTTPS will not be available for the website. Revocation typically occurs only if the certificate was wrongfully issued, the certificate owner violated the terms of the certificate, or the certificate authority identifies malicious behaviors like phishing that stem from the domain. However, if your SSL certificate is revoked, it needs to be replaced with a new certificate from a valid certificate authority as quickly as possible to ensure continuity for protected data transfer between affected servers and their clients. Continuous monitoring with UpGuard Breach Risk can help you ensure that no revoked certificates are in use among your assets. ### Strengthen the Security Configuration In addition to the misconfiguration findings detailed in this post, you can protect against attack vectors resulting from default configurations and unnecessary features. Upgrade weaknesses in your algorithms and cipher suites in alignment with the [Open Worldwide Application Security Project (OWASP) guidance](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/01-Testing_for_Weak_SSL_TLS_Ciphers_Insufficient_Transport_Layer_Protection). Strong security controls, like forward secrecy in your cipher suite, ensure that sensitive data remains encrypted against brute force attacks or unauthorized access. Change the default settings and avoid default passwords so that hackers cannot gain access to your application stack or escalate permissions within your application server. eBook Top Security Misconfigurations Causing Data Breaches Free resource ### Top Security Misconfigurations Causing Data Breaches [Download now](/resources/top-security-misconfigurations-causing-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 26, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)