tlsx icon indicating copy to clipboard operation
tlsx copied to clipboard

Add support for detecting whether a server requires clients to authenticate using a client certificate

Open mark-adams opened this issue 1 year ago • 1 comments

Please describe your feature request:

I would like tlsx to return back a client_cert_required attribute to indicate whether or not the remote server requires clients to authenticate using a certificate.

Describe the use case of this feature:

A common security practice when using third-party edge services like Cloudflare is to require mutual TLS between the edge service and the backend web servers to ensure that third-parties are not able to bypass the edge service and make requests to the web servers directly. In these cases, it is useful to be able to scan a particular set of endpoints to determine whether or not there are any that are missing this control that need to be remediated.

mark-adams avatar Jun 25 '24 15:06 mark-adams

Thanks for this feature request @mark-adams , we'll definitely take a look into it!

GeorginaReeder avatar Jun 25 '24 16:06 GeorginaReeder

@mark-adams this is now included in latest release of tlsx - https://github.com/projectdiscovery/tlsx/releases/tag/v1.1.7

ehsandeep avatar Aug 12 '24 10:08 ehsandeep