---
title: "P4: TLS, Certificates and HTTPS"
canonical: https://openvapt.com/academy/p4.html
html: https://openvapt.com/academy/p4.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# P4: TLS, Certificates and HTTPS

How encryption in transit works in practice, which TLS versions are acceptable, and how certificates and HSTS keep users safe.

- Level: Practitioner
- Time: about 20 minutes
- Read first: P3

## You Will Be Able To

- Explain why TLS 1.0 and 1.1 are deprecated.
- Recognise expired, self-signed and mismatched certificates.
- Explain what HSTS and HTTP-to-HTTPS redirects protect against.

## Protocol Versions

TLS 1.0 and 1.1 were formally deprecated by RFC 8996 in 2021. Servers should offer TLS 1.2 and TLS 1.3 only. OpenVAPT tests this by attempting handshakes limited to the old versions against 127.0.0.1.

## Certificates

A certificate proves a server's identity for the names it lists. Expired, self-signed or mismatched certificates cause browser warnings, which train users to click through the very warning that protects them from interception.

## HTTPS Everywhere

Serving pages over plain HTTP lets anyone on the path read or change them. Redirecting HTTP to HTTPS, and sending Strict-Transport-Security so browsers refuse to downgrade, closes that gap.

## In Summary

Offer TLS 1.2 and 1.3 only. A certificate must match the name, be valid and be renewed in time. HSTS stops a downgrade to plain HTTP.

## Apply It

- [NET-TLS-001 Deprecated TLS 1.0 or 1.1 Accepted](https://openvapt.com/checks/NET-TLS-001.md) (medium)
- [NET-TLS-002 TLS Certificate Expired or Expiring Soon](https://openvapt.com/checks/NET-TLS-002.md) (medium)
- [NET-TLS-003 Self-Signed or Mismatched TLS Certificate](https://openvapt.com/checks/NET-TLS-003.md) (medium)
- [NET-TLS-004 Weak TLS 1.2 Cipher Suites Accepted](https://openvapt.com/checks/NET-TLS-004.md) (medium)
- [NET-TLS-005 TLS Certificate Public Key Too Small](https://openvapt.com/checks/NET-TLS-005.md) (medium)
- [NET-TLS-006 SHA-1 Signed TLS Leaf Certificate](https://openvapt.com/checks/NET-TLS-006.md) (medium)
- [WEB-HDR-001 Missing HTTP Strict Transport Security (HSTS)](https://openvapt.com/checks/WEB-HDR-001.md) (medium)
- [WEB-TLS-001 Site Available Over Plain HTTP Without Redirect](https://openvapt.com/checks/WEB-TLS-001.md) (medium)

## Lab

1. `Run: openvapt demo --only NET-TLS-,WEB-TLS-001,WEB-HDR-001`
2. `On your own server: openssl s_client -connect 127.0.0.1:443 -tls1_1 </dev/null and explain the result.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. Which TLS versions should a server offer today?
   - A. TLS 1.0 and above
   - B. TLS 1.2 and TLS 1.3
   - C. SSL 3.0 and TLS 1.0
   - D. TLS 1.1 and TLS 1.2
   - Answer: B. RFC 8996 deprecated TLS 1.0 and 1.1, so only TLS 1.2 and 1.3 remain.

2. What does HSTS do?
   - A. Encrypts the database
   - B. Tells browsers to always use HTTPS for the site
   - C. Blocks bots
   - D. Hides the server version
   - Answer: B. Strict-Transport-Security makes browsers refuse to downgrade to plain HTTP for that site.

3. Why are self-signed certificates a problem on public sites?
   - A. Browsers do not trust them, so users learn to ignore warnings
   - B. They expire faster
   - C. They use weak keys
   - D. They cannot be used with TLS 1.3
   - Answer: A. Users trained to click through warnings lose their protection against interception.

4. Which RFC deprecated TLS 1.0 and TLS 1.1?
   - A. RFC 6797
   - B. RFC 8996
   - C. RFC 9142
   - D. RFC 5246
   - Answer: B. RFC 8996 (2021) deprecated them. RFC 6797 defines HSTS, RFC 9142 covers SSH key exchange and RFC 5246 defines TLS 1.2.

5. A valid certificate lists only www.example.com. A user visits shop.example.com on the same server. What happens?
   - A. Nothing, any certificate from that server works
   - B. The browser warns that the name does not match
   - C. The connection falls back to TLS 1.0
   - D. HSTS fixes the mismatch
   - Answer: B. A certificate proves identity only for the names it lists. Any other name gets a mismatch warning.

6. How does OpenVAPT test for old TLS versions?
   - A. It reads the certificate expiry date
   - B. It attempts handshakes limited to the old versions against 127.0.0.1
   - C. It scans other servers on the internet
   - D. It checks the HSTS header
   - Answer: B. If a handshake limited to TLS 1.0 or 1.1 succeeds on loopback, the server still offers it.

## Key Terms

- TLS: Transport Layer Security: the protocol that encrypts connections such as HTTPS.
- Certificate: A signed digital document that binds a public key to names such as a website's domain, used by TLS to prove identity.
- HSTS: HTTP Strict Transport Security: a header that tells browsers to use only HTTPS for a site.
- Downgrade Attack: Forcing a connection to use a weaker protocol or no encryption, for example from HTTPS to HTTP.

## References

- [RFC 8996, Deprecating TLS 1.0 and TLS 1.1](https://www.rfc-editor.org/rfc/rfc8996.html)
- [NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations](https://csrc.nist.gov/pubs/sp/800/52/r2/final)
- [RFC 6797, HTTP Strict Transport Security](https://www.rfc-editor.org/rfc/rfc6797.html)

Offline: `openvapt learn P4`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p4.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.