http-tls
Uses TLS off the local machine
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain http-tls.
- pack
http- weight
- advisory · not scored
- scope
- environment (the URL as configured)
- decided by
- static
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
checks.http-tls.enabledchecks.http-tls.severityserver.url
Probes
schemehttps: passes; http: to a non-loopback host is noted
Settings and thresholds
Every check also takes checks.http-tls.enabled and checks.http-tls.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
server.url | none | not locked | URL of a Streamable HTTP server. Alone it must already be running; with command, Sealmark starts it and waits for this URL. |
How the verdict is established
- Scoring. advisory: reported with its verdict but not part of the score.
What to fix
Serve over https (or terminate TLS in a proxy and use the https URL) for any address that is not this machine. This check is advisory.
False positives
Plain http inside a trusted private network, or TLS terminated by a proxy in front.
False negatives
Certificate validity, protocol versions and cipher choices are not examined.