SSL/TLS Check (ssl-tls-check)

Summary

Certificate validity, protocol strength, and HSTS preload signals.

Classification

• Category: SECURITY
• Plugin id: ssl-tls-check
• Version: 1.0.0
• Target types: WEBSITE, API, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 8 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
warnDays	Zod field in inputSchema — see source for defaults, min/max, and .describe().
criticalDays	Zod field in inputSchema — see source for defaults, min/max, and .describe().
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for ssl-tls-check.

Check	Typical severity	Why
SSL certificate expired	CRITICAL	Browsers show interstitial warnings and many clients refuse the connection — the site is effectively unreachable over HTTPS.
Certificate expires within critical window (default 7 days)	WARNING	Automated renewal (Let’s Encrypt, ACME) can fail silently; sub-week expiry often means outage during the next maintenance window.
Certificate expires within warn window (default 30 days)	WARNING	Provides lead time before CRITICAL; expired certs also break webhooks, pinned mobile apps, and third-party integrations.
Weak TLS protocol (TLSv1 / TLSv1.1)	WARNING	TLS 1.0/1.1 are deprecated (PCI, browser blocklists); weak negotiation indicates outdated server config and downgrade risk.

How each check works

1. Target parsing — Extracts hostname and port from the target URL (default port 443 if omitted). Invalid URL → run failed with no findings.
2. TLS handshake — Opens tls.connect() with SNI (servername), rejectUnauthorized: false (expired certs remain readable), and configurable timeout (default 10s).
3. Certificate expiry — Computes daysUntilExpiry from cert.valid_to. CRITICAL if ≤ 0 days; WARNING if ≤ criticalDays (default 7); separate WARNING if ≤ warnDays (default 30) but above the critical window. Only one expiry finding is emitted (mutually exclusive branches).
4. Protocol check — Reads negotiated protocol via socket.getProtocol(). WARNING if TLSv1 or TLSv1.1.
5. Run outcome — Score 100 if clean, 50 if warnings only, 0 if CRITICAL. TLS connection errors return failed with empty findings (not a certificate finding).

Caveats and concerns

• No HSTS preload check — Despite the high-level summary, the plugin does not inspect HSTS or preload list membership; only cert expiry and negotiated protocol.
• Accepts invalid chains — rejectUnauthorized: false means mis-issued or untrusted CAs are not flagged — only expiry and protocol.
• Single endpoint — One TLS handshake to hostname:port; does not scan alternate hosts (www vs apex) or mail/IMAP ports.
• Shared hosting — Certificate issuer/SAN coverage for aliases is not validated; a valid cert on the wrong vhost may pass.

Source

packages/test-plugins/src/plugins/ssl-tls-check.ts