TLS cipher audit checklist | Automate Certificates

TLS 1.0 and 1.1 disabled on all public terminators

TLS 1.3 enabled where client base supports it

Forward secrecy ciphers only (no static RSA key exchange)

Weak ciphers removed (3DES, RC4, NULL, EXPORT)

Certificate chain served complete including intermediates

HSTS enabled with appropriate max-age on apex domains

OCSP stapling configured and verified on edge nodes

Perfect forward secrecy verified via openssl s_client scan

Internal mTLS uses distinct CA from public edge certs

Cipher suites documented and reviewed quarterly

Automated scan (testssl.sh or sslyze) in CI or monthly cron

Post-renewal handshake check against live hostname