tls_security.yaml

apiVersion: kopexa.io/v1alpha1
kind: Policy
metadata:
  name: kopexa-tls-security
  title: Kopexa TLS/SSL Security
  version: 1.4.1
scoring_system: banded

groups:
  - title: Secure TLS/SSL connection
    filter: asset.type == 'host'
    checks:
      - uid: kopexa-tls-security-ciphers-include-aead-ciphers
      - uid: kopexa-tls-security-ciphers-include-pfs
      - uid: kopexa-tls-security-mitigate-beast
      - uid: kopexa-tls-security-no-diffie-hellman-cipher-suites
      - uid: kopexa-tls-security-no-export-cipher-suites
      - uid: kopexa-tls-security-no-null-cipher-suites
      - uid: kopexa-tls-security-no-old-cipher-suites
      - uid: kopexa-tls-security-no-rc4-ciphers
      - uid: kopexa-tls-security-no-rsa-key-exchange
      - uid: kopexa-tls-security-no-weak-block-cipher-modes
      - uid: kopexa-tls-security-no-weak-block-ciphers
      - uid: kopexa-tls-security-no-weak-tls-versions
  - title: Valid TLS/SSL certificate
    filter: asset.type == 'host'
    checks:
      - uid: kopexa-tls-security-cert-domain-name-match
      - uid: kopexa-tls-security-cert-is-valid
      - uid: kopexa-tls-security-cert-no-cert-expired
      - uid: kopexa-tls-security-cert-no-certs-expired
      - uid: kopexa-tls-security-cert-no-weak-signature
      - uid: kopexa-tls-security-cert-not-revoked
      - uid: kopexa-tls-security-cert-not-self-signed

queries:
  - uid: kopexa-tls-security-cert-domain-name-match
    title: Certificate's domain name must match
    resource: tls
    severity: critical
    query: |
      resource.certificates[0].subject.commonName == asset.name ||
      resource.certificates[0].dnsNames.exists(n, n == asset.name)
    docs: Certificate domain name must match the hostname.
    remediation: Get a certificate that matches the domain.
    audit: Check commonName and SANs.

  - uid: kopexa-tls-security-cert-is-valid
    title: Certificate is valid
    resource: tls
    severity: critical
    query: |
      resource.certificates[0].expiresIn.days >= 0 &&
      resource.certificates[0].validityDays <= 398 &&
      resource.certificates[0].isVerified
    docs: |
      Certificate must be valid, not expired, trusted by root CAs, and have validity period
      within CA/Browser Forum limits (currently 398 days, reducing to 47 days by 2029).
    remediation: Renew certificate with valid parameters.
    audit: Check details.

  - uid: kopexa-tls-security-cert-no-cert-expired
    title: Certificate is not near expiration or expired
    resource: tls
    severity: high
    query: resource.certificates[0].expiresIn.days > 30
    docs: Renew certificate before it expires (30 days buffer).
    remediation: Renew soon.
    audit: Check days remaining.

  - uid: kopexa-tls-security-cert-no-certs-expired
    title: None of the certificates (intermediate or root) have expired
    resource: tls
    severity: critical
    query: resource.certificates.all(c, c.expiresIn.days >= 0)
    docs: All certificates in chain must be valid.
    remediation: Update full chain.
    audit: Check chain.

  - uid: kopexa-tls-security-cert-not-self-signed
    title: Do not use a self-signed certificate
    resource: tls
    severity: high
    query: resource.certificates[resource.certificates.size()-1].isCA
    docs: Do not use self-signed certificates.
    remediation: Get CA signed cert.
    audit: Check issuer.

  - uid: kopexa-tls-security-cert-not-revoked
    title: Do not use revoked certificates
    resource: tls
    severity: critical
    query: "true"
    docs: (Not implemented) Check for revocation.
    remediation: Replace revoked certs.
    audit: None

  - uid: kopexa-tls-security-cert-no-weak-signature
    title: Do not use weak certificate signatures
    resource: tls
    severity: high
    query: |
      resource.certificates.all(c, !c.signingAlgorithm.matches('(?i)md2|md5|sha1'))
    docs: Use strong signature algorithms (SHA256+).
    remediation: Reissue with SHA256.
    audit: Check signature algorithm.

  - uid: kopexa-tls-security-no-weak-tls-versions
    title: Avoid weak SSL and TLS versions
    resource: tls
    severity: critical
    query: |
      resource.versions.all(v, v == 'tls1.2' || v == 'tls1.3')
    docs: Disable TLS 1.0, 1.1, SSL.
    remediation: Configure server to disable old protocols.
    audit: Check supported protocols.

  - uid: kopexa-tls-security-no-rc4-ciphers
    title: Avoid RC4 ciphers
    resource: tls
    severity: critical
    query: resource.ciphers.all(c, !c.matches('(?i)rc4'))
    docs: Disable RC4.
    remediation: Disable RC4 ciphers.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-null-cipher-suites
    title: Avoid NULL cipher suites
    resource: tls
    severity: critical
    query: resource.ciphers.all(c, !c.matches('(?i)null'))
    docs: Disable NULL ciphers.
    remediation: Disable NULL suites.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-export-cipher-suites
    title: Avoid export ciphers suites
    resource: tls
    severity: critical
    query: resource.ciphers.all(c, !c.matches('(?i)export'))
    docs: Disable EXPORT ciphers.
    remediation: Disable EXPORT suites.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-diffie-hellman-cipher-suites
    title: Avoid anonymous Diffie-Hellman suites
    resource: tls
    severity: high
    query: resource.ciphers.all(c, !c.matches('(?i)dh_anon'))
    docs: Disable anonymous DH.
    remediation: Disable DH_ANON.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-weak-block-ciphers
    title: Avoid weak block ciphers
    resource: tls
    severity: high
    query: resource.ciphers.all(c, !c.matches('(?i)des|rc2|idea'))
    docs: Disable weak block ciphers (DES, RC2, IDEA).
    remediation: Use AES.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-weak-block-cipher-modes
    title: Avoid weak block cipher modes
    resource: tls
    severity: medium
    query: resource.ciphers.all(c, !c.matches('(?i)cbc'))
    docs: Avoid CBC mode.
    remediation: Use GCM/ChaCha20.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-rsa-key-exchange
    title: Avoid cipher suites with RSA key exchange
    resource: tls
    severity: medium
    query: resource.ciphers.all(c, !c.matches('(?i)^tls_rsa'))
    docs: Avoid RSA key exchange (no PFS).
    remediation: Use ECDHE/DHE.
    audit: Check ciphers.

  - uid: kopexa-tls-security-no-old-cipher-suites
    title: Avoid old cipher suites
    resource: tls
    severity: high
    query: resource.ciphers.all(c, !c.matches('(?i)^old'))
    docs: Avoid old suites.
    remediation: Update ciphers.
    audit: Check ciphers.

  - uid: kopexa-tls-security-ciphers-include-aead-ciphers
    title: Preferred ciphers must include AEAD ciphers
    resource: tls
    severity: medium
    query: resource.ciphers.exists(c, c.matches('(?i)chacha20_poly1305|gcm|ccm'))
    docs: Use AEAD ciphers.
    remediation: Enable AEAD.
    audit: Check for GCM/ChaCha.

  - uid: kopexa-tls-security-ciphers-include-pfs
    title: Preferred ciphers must include perfect forward secrecy (PFS)
    resource: tls
    severity: high
    query: resource.ciphers.exists(c, c.matches('(?i)ecdhe_(rsa|ecdsa)|dhe_(rsa|dss)|cecpq'))
    docs: Use PFS (ECDHE/DHE).
    remediation: Enable PFS.
    audit: Check for ECDHE.

  - uid: kopexa-tls-security-mitigate-beast
    title: Mitigate BEAST attacks on the server-side
    resource: tls
    severity: high
    query: |
      resource.versions.all(v, v == 'tls1.2' || v == 'tls1.3') ||
      resource.ciphers.all(c, c.matches('(?i)rc4')) ||
      resource.ciphers.all(c, !c.matches('(?i)null|dh_anon|export|des|rc2|idea'))
    docs: Mitigate BEAST (use TLS 1.2+).
    remediation: Enforce TLS 1.2+.
    audit: Check version.