tlsx
tlsx copied to clipboard
Add support for detecting whether a server requires clients to authenticate using a client certificate
Please describe your feature request:
I would like tlsx to return back a client_cert_required attribute to indicate whether or not the remote server requires clients to authenticate using a certificate.
Describe the use case of this feature:
A common security practice when using third-party edge services like Cloudflare is to require mutual TLS between the edge service and the backend web servers to ensure that third-parties are not able to bypass the edge service and make requests to the web servers directly. In these cases, it is useful to be able to scan a particular set of endpoints to determine whether or not there are any that are missing this control that need to be remediated.
Thanks for this feature request @mark-adams , we'll definitely take a look into it!
@mark-adams this is now included in latest release of tlsx - https://github.com/projectdiscovery/tlsx/releases/tag/v1.1.7