BERRY9 IT Services, home +91 86868 92922

TLS Misconfigurations That Still Matter in 2026

TLS is largely a solved problem. Modern stacks default to TLS 1.3, strong cipher suites, and OCSP stapling. SSL Labs gives most sites an A. So why does TLS still come up in penetration test reports? Because the misconfigurations that remain are subtle and they still matter.

Request a scoping call Call +91 86868 92922

Network · By Thimmagurudu Bathini · Published · 5 min read · Last reviewed

Protocol versions

TLS 1.0 and 1.1 are deprecated since 2020. They should not be enabled anywhere. They still turn up on legacy load balancers, internal services, and admin portals. PCI DSS expects strong cryptography, which in practice means TLS 1.2 or later.

Cipher suite selection

Anything without forward secrecy (ECDHE or DHE key exchange) means past traffic can be decrypted if the private key is later compromised. RSA key exchange is the prime culprit — still enabled on many production endpoints.

Certificate hygiene

  • Certificates approaching expiry with no rotation calendar
  • Wildcard certificates that span more than they should — a compromise on one host compromises every host
  • Self-signed certificates on internal services that the rest of the infrastructure has been taught to ignore — making real MITM trivial once inside
  • Long-lived intermediate CA trust on devices that should not trust them (corporate-internal CAs in customer-facing browsers)

HSTS with a meaningful max-age (one year), preload submitted, includeSubDomains where appropriate. Without HSTS, the first HTTP request is downgrade-able.

Mutual TLS for service-to-service

Internal APIs that talk to each other over TLS without mutual auth are trusting the network. Zero-trust architectures require mTLS between services. It is worth testing for on any internal network. See network penetration testing.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp