TLS certificate
Summary: PortSwigger Research describes TLS (or SSL) as protecting the confidentiality and integrity of data in transit between browser and server and authenticating the server's identity, which requires the server to present a certificate valid for its hostname, issued by a trusted authority, and valid for the current date. The text states that if any one of these requirements is not met, TLS connections will not provide the full protection for which TLS is designed, and notes that various attacks exist against TLS in general and against HTTPS web connections in particular.
What's compelling: The source notes that a determined and suitably-positioned attacker may be able to compromise TLS connections without user detection even when a valid TLS certificate is used, so a passing certificate check is not proof the connection is safe.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026