Skip to content
Bugb Docs

cxgTemplates

TLS Certificate Deep Analysis

tls-certificate-deep-analysis is a high severity check in the network category, written in rust. Its source is templates/network/tls/src/main.rs in cert-x-gen-templates.

What it checks

Section titled “What it checks”

Deep X.509 certificate chain analysis detecting expired certs, weak keys, deprecated signature algorithms, self-signed roots, hostname mismatches, missing SANs, CA constraint violations, and chain integrity issues that enable MITM attacks or authentication bypass.

Section titled “Header”
Field Value
Id tls-certificate-deep-analysis
Severity high
Language rust
Category network
Author BugB Technologies
Template version not recorded
Confidence 92
CVSS not recorded
Weakness CWE-295
Tags tls, ssl, x509, certificate, chain-validation, weak-crypto, expired-cert, self-signed, sha1, mitm, pki, rfc5280
Target kind not recorded
Oracle not recorded

References

Section titled “References”

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

Run it

Section titled “Run it”

To see what the copy on your machine says about itself, and to confirm it is installed at all:

Terminal window
cxg template info tls-certificate-deep-analysis

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Section titled “Related”