> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/observer/which-web-encryption-checks-does-the-enginsight-observer-perform.md). # Which web encryption checks does the Enginsight Observer perform? The Observer is an Enginsight component that can be installed on systems at different locations to monitor endpoints externally. In Enginsight, endpoints are internal and external websites and domains. Monitoring also includes checking the SSL/TLS encryption of the endpoint for known vulnerabilities caused by misconfigurations or the use of outdated technologies. The Observer performs the following web encryption checks:

Check name	Description
Certificate chain too long	The certificate chain is too long and therefore does not comply with the certificate authority's requirements.
Certificate CRL unavailable	The certificate revocation list is unavailable, which causes connection failures.
Certificate is not trusted	The certificate in use is considered untrusted.
Certificate issuer cannot be determined	SSL/TLS certificates are issued by Certificate Authorities, which must be identifiable.
Certificate rejected	The certificate in use causes problems and is therefore rejected.
Certificate revoked	The certificate in use has been revoked and should no longer be used.
Certificate signature cannot be decrypted	The signature of a certificate allows a third party to confirm the identity of the certificate owner. It should therefore be readable.
Cipher supports MD5	The MD5 (Message-Digest Algorithm 5) hash function is no longer considered sufficiently secure and should therefore not be used.
CRL signature cannot be decrypted	A CRL signature that cannot be decrypted may indicate that the certificate revocation list is corrupted, expired, or that the signature chain to the certificate authority is broken. As a result, certificates cannot be verified as valid.
Does not support the latest protocol (TLSv1.3)	The latest and most secure protocol, TLS 1.3, is not supported.
Expired certificate	The SSL/TLS certificate in use has expired and is therefore invalid. Secure transactions can no longer be performed.
Expired CRL (Certificate Revocation List) validity period	The validity period of the certificate revocation list in use has expired. An outdated CRL may no longer indicate, for example, whether a key has been compromised.
Format error in the CRL lastupdate field	The lastupdate field, which indicates the last update in the CRL, contains an invalid time.
Format error in the CRL nextupdate field	The nextupdate field, which indicates the next scheduled update in the CRL, contains an invalid time.
Format error in the certificate notafter field	The notafter field, which indicates the end of the CRL validity period, contains an invalid time.
Format error in the certificate notbefore field	The notbefore field, which indicates the start of the CRL validity period, contains an invalid time.
Invalid CA certificate	The certificate issued by the certificate authority is invalid.
Invalid certificate	The SSL/TLS certificate in use is invalid and should no longer be used.
Invalid certificate expiration date	The expiration date of the certificate in use is not correct.
Invalid certificate signature	The digital signature of the SSL/TLS certificate cannot be verified.
Invalid CRL (Certificate Revocation List)	The certificate revocation list in use is invalid.
Invalid CRL (Certificate Revocation List) signature	The digital signature of the certificate revocation list cannot be verified.
Invalid hostname	The certificate does not contain the hostname of the target system.
Key usage does not include certificate signing	A certificate is used to sign other certificates even though the Key Usage attribute does not allow this, which means the certificate is actually invalid.
Local issuer certificate unavailable	An SSL/TLS connection cannot be established because the client cannot find the certificate of the issuing certificate authority in its local store.
Mismatch between certificate authority and issuer	The certificate authority (CA) and issuer do not match.
Mismatch between certificate authority and issuer serial number	The certificate authority and issuer serial number do not match.
Missing Common Name in Subject Alternative Names	The Common Name is not included in the Subject Alternative Names, which blocks certificate validation.
No support for Authenticated Encryption (AEAD) ciphers	The AEAD encryption standard is recommended because it ensures the confidentiality (unreadability) and integrity (immutability) of a message.
No support for Perfect Forward Secrecy (PFS)	Support for PFS is recommended. It ensures that each newly negotiated session key cannot be reconstructed from the long-term key.
No support for Secure Renegotiation	The server is unable to initiate secure renegotiation of the SSL/TLS connection. Insecure renegotiation makes the connection vulnerable to man-in-the-middle attacks, allowing, for example, existing encrypted sessions to be manipulated.
Path length constraint exceeded	The path length constraint specified by the certificate authority has been exceeded. This may indicate a forged certificate.
Public key cannot be decoded	The public key is used to enable secure key exchange. It should therefore be decodable.
Self-signed certificate	Self-signed certificates are not validated by a trusted certificate authority and are therefore not recommended.
Self-signed certificate in the certificate chain	Self-signed certificates are not validated by a trusted certificate authority and are therefore not recommended.
Supports anonymous ciphers	Anonymous ciphers are insecure and should not be used.
Supports ciphers vulnerable to POODLE attacks	POODLE attacks exploit a vulnerability in SSL 3.0, allowing encrypted information from an SSL 3.0 connection to be disclosed.
Supports client-initiated SSL/TLS renegotiation	Clients should not be allowed to initiate renegotiation of the SSL/TLS connection. This functionality can be exploited to deliberately overload the server and perform a denial-of-service (DoS) attack.
Supports null cipher encryption	A null cipher means that no encryption is used at all. This is never recommended outside of testing purposes.
Supports RC4 ciphers	RC4 is no longer considered sufficiently secure and should therefore not be used.
Supports SSL/TLS compression	The use of SSL/TLS compression, a feature for reducing the amount of data before encryption, is not recommended because it makes SSL/TLS vulnerable, especially to CRIME (Compression Ratio Info-Leak Made Easy).
Supports vulnerable ciphers	Ciphers that include insecure cryptographic methods should not be offered.
Supports weak SSL/TLS cipher (algorithm)	SSL/TLS ciphers define which encryption algorithms are used to exchange keys and secure communication. If insecure SSL/TLS ciphers are offered, the established connection is no longer secure.
Supports weak SSL/TLS cipher (parameters)	SSL/TLS ciphers define which encryption algorithms are used to exchange keys and secure communication. If insecure SSL/TLS ciphers are offered, the established connection is no longer secure.
Supports weak SSL/TLS handshake parameters	During the creation and verification of signatures in the TLS handshake, an insecure signature algorithm and/or an insecure hash function is used.
The certificate chain could not be verified	The browser cannot verify the certificate chain. As a result, it cannot confirm the trustworthiness of a server.
Unsupported certificate purpose	A certificate is being used for a purpose for which it was not signed.
Uses known Diffie-Hellman prime	Using an insecure Diffie-Hellman prime compromises encryption.
Vulnerable to DROWN	The web server uses the outdated SSLv2 protocol. This can allow recorded TLS traffic, among other things, to be intercepted.
Vulnerable to FREAK	In a FREAK attack, the communication partners are forced to agree on an insecure encryption method even though secure methods are available. This makes it easier to intercept and manipulate data.
Vulnerable to Heartbleed	Due to a programming error in OpenSSL, the server can be manipulated in a way that causes it to disclose sensitive information.
Vulnerable to Logjam attack	By exploiting a vulnerability in the Diffie-Hellman key exchange, attackers can obtain secret keys.
Vulnerable to NULL pointer dereference	By sending a malicious certificate, an attacker can cause a denial-of-service condition.
Vulnerable to SLOTH attack	Weak hash functions (MD5, SHA-1) allow a SLOTH attack. This can lead to identity theft (impersonation), interception of login credentials, and weakened encryption.
Vulnerable to Sweet32 attacks	The RC4 stream cipher makes the connection vulnerable to Sweet32 attacks. By intercepting large amounts of data in a long session, an attacker can create collisions to decrypt encrypted data, such as session cookies, and take over HTTPS connections.
Vulnerable under the requirements of the General Data Protection Regulation (GDPR)	The SSL/TLS encryption does not reflect the current state of the art and therefore violates Art. 32 GDPR.
Vulnerable under the requirements of the BSI (German Federal Office for Information Security)	The SSL/TLS encryption does not meet the requirements of the BSI.
Weak Diffie-Hellman parameter	A weak Diffie-Hellman parameter makes the key exchange vulnerable to attacks.

***