OpenVAPTTLS, Certificates and HTTPS
How encryption in transit works in practice, which TLS versions are acceptable, and how certificates and HSTS keep users safe.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/p4.html. Offline: openvapt learn P4.
Read First: P3
You Will Be Able To
- Explain why TLS 1.0 and 1.1 are deprecated.
- Recognise expired, self-signed and mismatched certificates.
- Explain what HSTS and HTTP-to-HTTPS redirects protect against.
Protocol Versions
TLS 1.0 and 1.1 were formally deprecated by RFC 8996 in 2021. Servers should offer TLS 1.2 and TLS 1.3 only. OpenVAPT tests this by attempting handshakes limited to the old versions against 127.0.0.1.
Certificates
A certificate proves a server's identity for the names it lists. Expired, self-signed or mismatched certificates cause browser warnings, which train users to click through the very warning that protects them from interception.
HTTPS Everywhere
Serving pages over plain HTTP lets anyone on the path read or change them. Redirecting HTTP to HTTPS, and sending Strict-Transport-Security so browsers refuse to downgrade, closes that gap.
In Summary
Offer TLS 1.2 and 1.3 only. A certificate must match the name, be valid and be renewed in time. HSTS stops a downgrade to plain HTTP.
Apply It
These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.
| Check | Title | Severity |
|---|---|---|
NET-TLS-001 | Deprecated TLS 1.0 or 1.1 Accepted | Medium |
NET-TLS-002 | TLS Certificate Expired or Expiring Soon | Medium |
NET-TLS-003 | Self-Signed or Mismatched TLS Certificate | Medium |
NET-TLS-004 | Weak TLS 1.2 Cipher Suites Accepted | Medium |
NET-TLS-005 | TLS Certificate Public Key Too Small | Medium |
NET-TLS-006 | SHA-1 Signed TLS Leaf Certificate | Medium |
WEB-HDR-001 | Missing HTTP Strict Transport Security (HSTS) | Medium |
WEB-TLS-001 | Site Available Over Plain HTTP Without Redirect | Medium |
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Run: openvapt demo --only NET-TLS-,WEB-TLS-001,WEB-HDR-001On your own server: openssl s_client -connect 127.0.0.1:443 -tls1_1 </dev/null and explain the result.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
- RFC 8996, Deprecating TLS 1.0 and TLS 1.1
- NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations
- RFC 6797, HTTP Strict Transport Security
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). P4: TLS, Certificates and HTTPS (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p4.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_p4,
author = {{OpenVAPT}},
title = {{P4: TLS, Certificates and HTTPS}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/p4.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.