Ensure that certificates attached to listeners are renewed before expiry without manual intervention.
Automate Listener Certificate Renewal
CCC.LB.CN18 · Encryption
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP11 | SSL/TLS Termination | The service can decrypt SSL or TLS encrypted traffic at the load balancer rather than at the backend servers, offloading the decryption task from the backend servers. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH07 | TLS Certificates Are Expired or Invalid | Stale or untrusted certificates weaken encrypted-traffic protection. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN18.AR01 | When a certificate is attached to a TLS or HTTPS listener, it MUST be issued by a certificate manager with automatic renewal enabled. | tlp-green, tlp-amber, tlp-red |
| CCC.LB.CN18.AR02 | When a certificate attached to a listener is within 30 days of expiry, the service MUST publish an alert to a monitored channel. | tlp-green, tlp-amber, tlp-red |