EMA Report Finds nearly 80% of SSL/TLS Certificates are Vulnerable to Man in the Middle Attacks

AppViewX commissioned study also reveals that up to 25% of all certificates are expired at any given time; Google’s proposed 90-day certificate expiration proposal driving need for lifecycle management automation

AppViewX, a leader in automated machine identity management (MIM) and application infrastructure security, today announced the results of a research study conducted by Enterprise Management Associates (EMA) on SSL/TLS Certificate Security. The survey found that nearly 80% of TLS certificates on the Internet are vulnerable to Man in the Middle (MiM) attacks, while as many as 25% of all certificates are expired at any given time.

A full copy of the AppViewX sponsored report is available here.

“We were surprised with the sheer volume of expired and self-signed certificates in circulation, and how many organizations are still not using TLS 1.2 and 1.3,” said Ken Buckler, CASP, Director of Information Security Research for EMA. “With Google’s proposed TLS certificate 90-day expiration mandate looming, it’s clear that the only path forward for IT administrators and security professionals is automated certificate management.”

Survey Highlights

As part of the study sponsored by AppViewX, EMA gathered data from multiple sources for this research report, including Google Trends from 5/6/2018 to 4/30/2023, Stack Exchange from 1/1/2009 to 12/31/2022, and Shodan in May 2023 focused on servers with SSL/TLS certificates on port 443. Some of the report’s key findings include:

• Only 21% of servers on the internet utilize TLS 1.3, meaning 79% of SSL certificates in use today are still subject to man-in-the-middle attacks
• Up to 25% of certificates on the internet pose a security threat because are expired (10%) or self-signed (15%) which are not considered secure for publicly accessible websites or services
• 45% of IP addresses exposed to Top 10 vulnerabilities also had expired certificates (22%) or self-signed certificates (23%)
• The Generic Top-Level Domains (gTLDs) with the most expired certificates are:
  
  .org (15%)
  
  .com (12%)
  
  .mil (11%)

“With almost six million expired SSL/TLS certificates currently in use on the internet and almost nine million self-signed certificates, this survey quantifies that many organizations are failing to perform basic certificate management hygiene,” said Murali Palanisamy, Chief Solutions Officer at AppViewX. “The recent certificate expiration incidents at Cisco, Microsoft and StarLink demonstrate the importance of automating the management of digital identities to eliminate critical outages and ensure strong security and risk postures.”

About AppViewX

AppViewX is trusted by the world’s leading organizations to reduce risk, ensure compliance, and increase visibility through automated machine identity management and application infrastructure security and orchestration. The AppViewX platform provides complete certificate lifecycle management and PKI-as-a-Service using streamlined workflows to prevent outages, reduce security incidents and enable crypto-agility.

Fortune 1000 companies, including six of the top ten global commercial banks, five of the top ten global media companies, and five of the top ten managed healthcare providers rely on AppViewX to automate NetOps, SecOps, and DevOps. AppViewX is headquartered in New York with offices in the U.K., Australia and three development centers of excellence in India. For more information, visit https://www.appviewx.com and follow us on LinkedIn and Twitter.

View source version on businesswire.com: https://www.businesswire.com/news/home/20230801017674/en/

.@AppViewX commissioned study by EMA finds nearly 80% of SSL/TLS certificates are vulnerable to man in the middle attacks and reveals that up to 25% of all certificates are expired at any given time