Find Vulnerable Public Key Encryption in Your Org

This guide helps you locate where your organization uses public key encryption that is now considered weak or vulnerable, such as RSA with 1024-bit keys, SHA-1 signed certificates, or outdated TLS versions. You will learn how to inventory your systems, identify the encryption parameters in use, and prioritize fixes. You’ll need administrative access to your network, a list of your external-facing services, and a few free tools.

What You’ll Need

• Administrative access to your domain’s DNS and your web servers (or a way to run commands on them).
• A list of your organization’s public IP addresses and domain names.
• Network scanning tools like Nmap, or online services like SSL Labs (for external services).
• Access to your certificate inventory (e.g., from your CA or a central management console).
• Basic command-line familiarity.

Step-by-Step

1. Create an inventory of all public-facing services. Start by listing every domain and IP that your organization exposes to the internet. Use your DNS records, cloud provider consoles, and any load balancer configurations. Include web servers, mail servers, VPN endpoints, and API gateways. This is your starting point.
2. Scan each service for its TLS configuration. Use Nmap with the ssl-enum-ciphers script to list which TLS versions and cipher suites are supported. For example: nmap --script ssl-enum-ciphers -p 443 example.com. Look for TLS 1.0 or 1.1, which are deprecated, and for cipher suites that use weak key exchange like export-grade or 512-bit RSA.
3. Check certificate key sizes and signature algorithms. For each certificate, note the public key algorithm (RSA, ECDSA, etc.) and the key size. Use OpenSSL to inspect a certificate: openssl s_client -connect example.com:443 -servername example.com | openssl x509 -text -noout. Look for RSA keys smaller than 2048 bits (especially 1024-bit) and any certificates signed with SHA-1. These are considered weak.
4. Search your internal infrastructure. Vulnerable encryption isn’t just external. Scan internal subnets for services that use old TLS or SSH. Use Nmap to scan internal IP ranges for port 443, 8443, 22, and 25. For SSH, check the host key type and size: ssh-keyscan -t rsa,ecdsa,ed25519 example.com. Look for 1024-bit RSA host keys, which are weak.
5. Review your certificate management system. If you have a central certificate authority (internal or external), export a list of all issued certificates. Look for any that are still using SHA-1 signatures or RSA-1024 keys. Many CAs now refuse to issue such certificates, but older ones may still be valid.
6. Check email encryption. If you use S/MIME or PGP, verify the key sizes. For S/MIME, inspect the certificates used for email signing/encryption. For PGP, check the key length: gpg --list-keys and look for RSA keys under 2048 bits. Also, check if your mail server supports STARTTLS with weak ciphers.
7. Document your findings. Create a spreadsheet with columns: service, host, port, TLS version, cipher suite, key algorithm, key size, signature hash, and risk level. Mark anything with TLS 1.0/1.1, RSA-1024, or SHA-1 as high risk. This becomes your remediation list.
8. Prioritize and plan remediation. Focus on externally exposed services first, then internal ones. For each, plan to upgrade to TLS 1.2 or 1.3, use RSA-2048 or ECDSA-256 or better, and ensure certificates are signed with SHA-256 or stronger. Set a timeline and assign owners.

Common Mistakes

• Only checking the default port (443). Many services run on custom ports like 8443, 9443, or 8080. Scan all open ports.
• Ignoring internal services. Attackers who breach the perimeter can exploit weak encryption internally. Include internal scans.
• Forgetting about certificates that are not yet expired. Even if a certificate is valid, it may use weak algorithms. Check the actual key and signature, not just the expiry date.
• Assuming TLS 1.2 is always safe. Some TLS 1.2 cipher suites are weak (e.g., those using CBC ciphers with known attacks). Use a tool that rates cipher strength.
• Not checking SSH host keys. Weak SSH host keys allow man-in-the-middle attacks. Include SSH in your scan.
• Overlooking email and VPN endpoints. These often use older encryption. Include them in your inventory.

Tips

• Automate scanning with a tool like nmap or a vulnerability scanner that includes TLS checks. Run scans on a schedule.
• Use online services like SSL Labs (for public-facing web servers) to get a detailed report and grade. It’s free and easy.
• When reviewing certificates, check the entire chain. A leaf cert might be strong, but the root or intermediate might be weak.
• For internal services, consider using a scanner like testssl.sh which is thorough and outputs clear results.
• Keep a central inventory of all certificates and their metadata. Use a tool like OpenSSL to generate a list.
• Before upgrading, test in a staging environment to ensure compatibility with older clients if you need to support them.

Troubleshooting

If your scan does not produce expected results, or you cannot connect to a service, try these steps:

• Connection refused or timeout: The service may be behind a firewall or not actually listening on that port. Double-check your IP and port. Try using nc -zv host port to test connectivity.
• Nmap script not running: Ensure you have the latest Nmap and the NSE scripts installed. Run nmap --script ssl-enum-ciphers with verbose output to see errors.
• Certificate inspection fails: If openssl s_client fails, the server may require SNI (Server Name Indication). Use the -servername option as shown. If it still fails, the service may not be TLS.
• Scanning internal IPs is slow: Use a smaller port list and increase parallelism. Or use a dedicated scanner like masscan for large ranges, then follow up with Nmap.
• You find weak encryption but can’t change it: Some legacy systems may not support modern TLS. In that case, isolate them (e.g., put them behind a VPN or a reverse proxy that terminates TLS securely) and document the risk.

Frequently Asked Questions

What exactly is “vulnerable” public key encryption?

It means the encryption is based on keys or algorithms that are no longer considered secure against current computational attacks. Common examples: RSA with keys shorter than 2048 bits, SHA-1 signatures, and TLS 1.0/1.1.

Why is RSA-1024 considered vulnerable?

RSA-1024 has a key size of 1024 bits. With modern computing power, factoring such keys is feasible for well-funded attackers. The industry standard is at least 2048 bits.

Can I detect weak encryption without scanning all my servers?

Yes, you can use a certificate inventory from your CA or a central management tool. But scanning is more thorough because it also reveals cipher suites and TLS versions.

What is the difference between a key size and a signature hash?

The key size is the length of the public key (e.g., RSA-2048). The signature hash is the algorithm used to sign the certificate (e.g., SHA-256). Both need to be strong.

How often should I run this audit?

At least annually, and after any major infrastructure change. Also, when new vulnerabilities are announced, re-scan to see if your systems are affected.

What if I find a vulnerable system but can’t replace it immediately?

Document it, apply compensating controls (like limiting access via firewall rules), and plan a migration. Consider using a reverse proxy to terminate TLS securely in front of it.

Related

• Volcanic Alert Levels: What Each Warning Means
• Jailbreak Apple TV 5 2 Untethered with Seas0nPass?
• GTA RP Explained: How Roleplay Servers Work