Automating TLS Configuration Verification
summary
Builds and releases TLS checks by adding Postgres and MySQL startTLS detection to testssl.sh, scans MySQL PostgreSQL and MongoDB defaults, and reports that defaults are often unsafe: 4.5 million MySQL instances are publicly reachable, many servers accept plaintext startTLS downgrades, and several cloud providers either ship vulnerable defaults or prevent TLS tuning. Shows that PostgreSQL can be hardened, MySQL Community ships with yaSSL (deprecated) unless recompiled, and publishes a blog and patched tool to verify and fix configs.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:09Outline
- 2:18The Simple Web Application
- 3:32Proper (current) TLS Configuration
- 12:16STARTTLS - MySQL
- 16:34MySQL Editions
- 23:36PostgreSQL
- 23:50The Cloud
- 25:18On-Premises Database
- 26:25MySQL Community Edition
- 27:07Internet Survey
related talks
41mState of MySQL Security in 2021
20mHardening MySQL: MySQL Security Basics - MySQL security Tutorial
18mBulletproofing your YugabyteDB Infrastructure to Reduce Risk
36mWhy TLS is better without STARTTLS ...
35mSecuring PostgreSQL From External Attack
38mRunning MySQL & MariaDB Server securely in 2019
05mRoad to Percona Live 2022 - Jonathan Katz
32mPicking the Low-Hanging Fruit – Easy Pentest Wins