SSL Certificate Signed Using Weak Hashing Algorithm

Tenable plugin 35291 fires when a remote TLS service presents any certificate in its chain signed with a weak hash algorithm such as MD2, MD4, MD5, or SHA-1; per Tenable, it also flags SHA-1 chains that expire after 2017-01-01. This is not a software-version bug with a neat affected range; the "affected versions" are effectively *any host or appliance still using an old certificate chain*, including self-signed internal certs, stale private-PKI leaf certs, and legacy appliance cert bundles.

The vendor's MEDIUM is technically defensible in a vacuum because weak-hash certificate signatures have real cryptographic history behind them. In enterprise reality, though, this finding is usually *over-prioritized*: exploitation generally needs an on-path position or some other traffic-redirection foothold, modern public-web clients have spent years distrusting SHA-1, and the blast radius is bounded to the specific trust path using the bad cert. For most fleets, this belongs in cleanup/backlog hygiene, not emergency patching.

Why this verdict

• Requires on-path control: the attacker normally needs DNS/network interception or some equivalent foothold before the weak cert helps them at all, which is a major downward adjustment from the vendor baseline.
• Client trust population is narrow: modern browsers and mainstream public-web clients have distrusted or degraded SHA-1 for years, so the reachable victim set is much smaller than the raw plugin count suggests.
• No host compromise primitive: this finding does not give RCE, privilege escalation, or direct service takeover by itself; impact is confined to impersonation of the specific TLS endpoint if multiple prerequisites are already met.

Why not higher?

A higher rating would fit an unauthenticated remote bug that yields code execution or trivial credential theft across a broad exposed population. This one needs a multi-step chain: on-path position, acceptable forged/substitute certificate, and clients that still trust the weak signature path. That is too much real-world friction for MEDIUM or HIGH in most fleets.

Why not lower?

It is not pure noise. Weakly signed certs still matter on internal admin planes, legacy middleware, appliances, and private PKI where browser-era protections do not save you. If the affected cert protects privileged traffic or high-value service identities, the local business impact of a successful MITM is real even if the exploit path is narrow.

1. Inventory weak-signature certs — Enumerate every service and chain element using MD2/MD4/MD5/SHA-1, then separate public-facing endpoints from internal-only and admin-plane services. For a LOW verdict there is no mitigation SLA; treat this as backlog hygiene, but complete the inventory during the next certificate hygiene cycle so you know which few hits actually matter.
2. Prioritize high-trust paths first — Pull forward replacement for certs protecting VPNs, SSO, admin consoles, mail gateways, load balancers, and other identity-heavy paths where MITM impact is disproportionate. Even though LOW has no formal mitigation deadline, these are the exceptions worth fixing early because the trust blast radius is higher.
3. Retire weak PKI templates — Update internal CA templates, appliance defaults, and automation so new enrollments cannot keep emitting weak signatures. For LOW, do this as routine PKI maintenance rather than emergency work, but close the template gap before your next renewal wave or you'll keep regenerating the problem.
4. Constrain interception opportunities — Reduce the chance of practical exploitation by hardening DNS, enforcing managed trust stores, using mTLS where appropriate, and limiting L2/L3 adjacency for sensitive apps. This is the right compensating control because the main exploit amplifier is on-path positioning, not a code bug on the endpoint.

Run this from an auditor workstation or jump host that can reach the target TLS service; it does not need to run on the target itself. Invoke it as ./check_weak_cert_sig.sh host:port for example ./check_weak_cert_sig.sh mail.example.com:443. No special privileges are required beyond network reachability and openssl installed locally.

#!/usr/bin/env bash
# check_weak_cert_sig.sh
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage / connection error

set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 host:port"
  exit 2
fi

if ! command -v openssl >/dev/null 2>&1; then
  echo "UNKNOWN - openssl not found"
  exit 2
fi

HOST="${TARGET%:*}"
PORT="${TARGET##*:}"
if [[ -z "$HOST" || -z "$PORT" || "$HOST" == "$PORT" ]]; then
  echo "UNKNOWN - target must be in host:port format"
  exit 2
fi

TMPDIR="$(mktemp -d 2>/dev/null || mktemp -d -t weakcert)"
trap 'rm -rf "$TMPDIR"' EXIT
CHAIN_FILE="$TMPDIR/chain.pem"
CERT_FILE="$TMPDIR/cert.pem"

# Pull the presented certificate chain.
if ! timeout 15 openssl s_client -connect "$HOST:$PORT" -servername "$HOST" -showcerts < /dev/null > "$CHAIN_FILE" 2>/dev/null; then
  echo "UNKNOWN - failed to connect or TLS handshake failed"
  exit 2
fi

awk 'BEGIN{c=0} /BEGIN CERTIFICATE/{c++; fn=sprintf("%s/cert-%02d.pem", ENVIRON["TMPDIR_OUT"], c)} c>0{print > fn} /END CERTIFICATE/{close(fn)}' TMPDIR_OUT="$TMPDIR" "$CHAIN_FILE"

shopt -s nullglob
CERTS=("$TMPDIR"/cert-*.pem)
if [[ ${#CERTS[@]} -eq 0 ]]; then
  echo "UNKNOWN - no certificates parsed from server response"
  exit 2
fi

WEAK_FOUND=0
DETAILS=()
INDEX=0
for CERT in "${CERTS[@]}"; do
  INDEX=$((INDEX+1))
  SIGALG="$(openssl x509 -in "$CERT" -noout -text 2>/dev/null | awk -F': ' '/Signature Algorithm/ {print $2; exit}')"
  SUBJECT="$(openssl x509 -in "$CERT" -noout -subject 2>/dev/null | sed 's/^subject=//')"
  if [[ -z "$SIGALG" ]]; then
    DETAILS+=("cert${INDEX}:unknown-signature:${SUBJECT:-unknown-subject}")
    continue
  fi

  SIGLOW="$(echo "$SIGALG" | tr '[:upper:]' '[:lower:]')"
  if [[ "$SIGLOW" =~ md2|md4|md5|sha1 ]]; then
    WEAK_FOUND=1
    DETAILS+=("cert${INDEX}:$SIGALG:${SUBJECT:-unknown-subject}")
  else
    DETAILS+=("cert${INDEX}:$SIGALG:${SUBJECT:-unknown-subject}")
  fi
done

if [[ $WEAK_FOUND -eq 1 ]]; then
  echo "VULNERABLE - weak certificate signature algorithm detected"
  printf '%s
' "${DETAILS[@]}"
  exit 1
fi

echo "PATCHED - no weak certificate signature algorithms detected in presented chain"
printf '%s
' "${DETAILS[@]}"
exit 0

Sources

1. Tenable Nessus Plugin 35291
2. Tenable Plugin 35291 Changelog
3. Mozilla Security Blog: Phasing Out Certificates with SHA-1 based Signature Algorithms
4. Chromium Blog: Gradually Sunsetting SHA-1
5. Google Security Blog: Announcing the first SHA1 collision
6. Microsoft Security Advisory 961509
7. NIST SP 800-107 Rev. 1
8. MITRE CWE-328: Use of Weak Hash