SSL/TLS Certificate Audit Checklist [FREE PDF]

SSL/TLS certificates are foundational to securing data in transit and are mandated by PCI DSS v4.0 Requirement 4.2.1, ISO/IEC 27001:2022 Annex A 8.24, and NIST SP 800-52 Rev 2. Expired, misconfigured, or weak-cipher certificates expose organizations to man-in-the-middle attacks, regulatory penalties, and loss of customer trust. This audit checklist ensures all certificates are valid, properly configured, and aligned with current cryptographic best practices across your infrastructure.

  • Industry: Information Technology
  • Frequency: Monthly
  • Estimated Time: 30-45 minutes
  • Role: Systems Administrator
  • Total Items: 36
  • Compliance: PCI DSS v4.0 Requirement 4.2.1, ISO/IEC 27001:2022 Annex A 8.24, NIST SP 800-52 Rev 2, HIPAA Security Rule 45 CFR §164.312(e)(1), GDPR Article 32(1)(a)

Certificate Inventory & Ownership

Verify a complete and up-to-date inventory of all SSL/TLS certificates exists and ownership is clearly defined.

  • Is a centralized inventory of all SSL/TLS certificates maintained and up to date?
  • Does each certificate have a designated owner or responsible team?
  • Are wildcard certificates documented separately with justification for their use?
  • Are all third-party or vendor-managed certificates included in the inventory?
  • Is the Certificate Authority (CA) used for each certificate recorded in the inventory?

Certificate Validity & Expiry

Confirm all certificates are valid, not expired, and that renewal processes are in place before expiry.

  • Are all active certificates currently within their validity period?
  • Are automated alerts configured to notify owners at least 30 days before expiry?
  • Do any certificates expire within the next 30 days?
  • Is the maximum certificate validity period limited to 398 days or less?
  • Is there a documented renewal procedure including rollback steps?

Protocol & Cipher Suite Strength

Verify that only secure TLS versions and cipher suites are in use, and deprecated protocols are disabled.

  • Are SSL 2.0, SSL 3.0, and TLS 1.0 fully disabled across all endpoints?
  • Is TLS 1.1 disabled on all servers and load balancers?
  • Are only TLS 1.2 and/or TLS 1.3 protocols enabled on production systems?
  • Are weak cipher suites (e.g., RC4, DES, 3DES, NULL, EXPORT ciphers) disabled?
  • Are cipher suites supporting Perfect Forward Secrecy (PFS) prioritized in configuration?
  • Has a recent automated scan (e.g., SSL Labs, testssl.sh) been run to validate cipher configuration?

Certificate Authority & Chain of Trust

Confirm certificates are issued by trusted CAs and that the full certificate chain is correctly configured.

  • Are all certificates issued by a publicly trusted Certificate Authority (CA)?
  • Is the full certificate chain (intermediate + root) correctly installed on all servers?
  • Are internal/private CA certificates used for internal services and properly distributed to endpoints?
  • Has Certificate Transparency (CT) logging been verified for all public-facing certificates?
  • Are revoked or distrusted CA certificates removed from the trust store on all systems?

Revocation & OCSP Configuration

Validate that certificate revocation checking is enabled and functional across all systems.

  • Is OCSP (Online Certificate Status Protocol) stapling enabled on all web servers?
  • Is CRL (Certificate Revocation List) checking configured as a fallback mechanism?
  • Has the revocation status of all in-scope certificates been verified within the last 30 days?
  • Is there a documented incident response procedure for emergency certificate revocation?

Private Key Management & Security

Ensure private keys are securely generated, stored, and protected from unauthorized access.

  • Are all private keys generated with a minimum key length of 2048-bit RSA or 256-bit ECC?
  • Are private keys stored in a Hardware Security Module (HSM) or equivalent secure vault?
  • Is access to private keys restricted to authorized personnel only with role-based controls?
  • Are private key access events logged and monitored for unauthorized access attempts?
  • Are private keys rotated whenever a certificate is renewed or reissued?

HTTPS Enforcement & Security Headers

Confirm HTTPS is enforced and supplementary security headers are correctly implemented.

  • Is HTTP Strict Transport Security (HSTS) enabled with a max-age of at least 6 months?
  • Are all HTTP requests automatically redirected to HTTPS (301/302 redirect)?
  • Is the HSTS preload list submission verified for all public domains?
  • Are mixed content warnings absent from all HTTPS-served pages?
  • Are findings from this audit documented and assigned remediation owners with deadlines?
  • Additional notes or observations from this SSL/TLS certificate audit?

Related Technology Checklists

Related Network Security Checklists

Why Use This SSL/TLS Certificate Audit Checklist [FREE PDF]?

This ssl/tls certificate audit checklist [free pdf] helps information technology teams maintain compliance and operational excellence. Designed for systems administrator professionals, this checklist covers 36 critical inspection points across 7 sections. Recommended frequency: monthly.

Ensures compliance with PCI DSS v4.0 Requirement 4.2.1, ISO/IEC 27001:2022 Annex A 8.24, NIST SP 800-52 Rev 2, HIPAA Security Rule 45 CFR §164.312(e)(1), GDPR Article 32(1)(a). Regulatory-aligned for audit readiness and inspection documentation.

Frequently Asked Questions

What does the SSL/TLS Certificate Audit Checklist [FREE PDF] cover?

This checklist covers 36 inspection items across 7 sections: Certificate Inventory & Ownership, Certificate Validity & Expiry, Protocol & Cipher Suite Strength, Certificate Authority & Chain of Trust, Revocation & OCSP Configuration, Private Key Management & Security, HTTPS Enforcement & Security Headers. It is designed for information technology operations and compliance.

How often should this checklist be completed?

This checklist should be completed monthly. Each completion takes approximately 30-45 minutes.

Who should use this SSL/TLS Certificate Audit Checklist [FREE PDF]?

This checklist is designed for Systems Administrator professionals in the information technology industry. It can be used for self-assessments, team audits, and regulatory compliance documentation.

Can I download this checklist as a PDF?

Yes, this checklist is available as a free PDF download. You can also use it digitally in the POPProbe mobile app for real-time data capture, photo documentation, and automatic reporting.

Browse More Checklists