PCI scan failure for SSL Certificate with Wrong Hostname

nessuspci-dssssl-certificate

A client had a PCI scan completed by SecurityMetrics, and it now says they failed due to the SSL certificate for the SMTP port 25 (and POP3s/IMAPS) not matching the domain scanned. Specifically:

Description: SSL Certificate with Wrong Hostname

Synoposis: The SSL certificate for this
service is for a different host.

Impact: The commonName (CN) of the SSL certificate
presented on this service is for a different machine.

The mail server uses sendmail (patched) and provides email service for a number of domains. The server itself has a valid SSL certificate, but it does not match each domain (as we add/remove domains all the time as clients move around).

Seems SecurityMerics is the only ASV that marks this as failing PCI. Trustwave, McAfee, etc… do not see this as failing PCI.

Is this issue truly a PCI failure? Or is it just SecuritMetrics being wrong?

Best Answer

This is what they call a false positive. We are using a wild card certificate so therefore the host name and certificate will not match. The certificate name will be the wild card name and the host would be domain.yourdomain.com and the SSL being a wild card will be *.yourdomain.com

Simply ask security metrics to whitelist that specific error if you are using a wild card cert.

You will have to get that to be the only error for the specific IP address. They can omit false positives.

Related Solutions

iis-7 – Using Multiple SSL Certificates on Same IP

You can bind only one SSL certificate per IP:port pair. If you need to run 2 HTTPS on the same IP -- bind them to different ports and then refer to such site providing port in URL (e.g. https://beta.example.com:444/). Otherwise you need another IP.

The reason is -- HTTP protocol kicks in only after secure channel has been established, which means only 1 SSL certificate can be used.

If you would have only one domain and wildcart certificate (*.domain.com), then you could try this article: http://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html , but your situation is different.

SSL Certificate – Displaying Remote SSL Certificate Details Using CLI Tools

You should be able to use OpenSSL for your purpose:

echo | openssl s_client -showcerts -servername gnupg.org -connect gnupg.org:443 2>/dev/null | openssl x509 -inform pem -noout -text

That command connects to the desired website and pipes the certificate in PEM format on to another openssl command that reads and parses the details.

(Note that "redundant" -servername parameter is necessary to make openssl do a request with SNI support.)

Best Answer

Related Solutions

iis-7 – Using Multiple SSL Certificates on Same IP

SSL Certificate – Displaying Remote SSL Certificate Details Using CLI Tools

Related Topic