AVerma (Community Member) asked a question.
CWE-296: Improper Following of a Certificate's Chain of Trust,
in Angular 10 application which is hosted on IIS.
in Angular 10 application which is hosted on IIS.
My Veracode dynamic scan come with the flaw CWE-296: Improper Following of a Certificate's Chain of Trust. It is an Angular 10 application and using IIS server. I am using the SSL certificate generated by company internally. But didn't get what caused this flaw. I read multiple articles on CWE-296 but that didnt help.
Could you please help me to resolve it or help me to find exact issue?
.png){kind=logo}
Hi @AVerma (Community Member),
Veracode Dynamic Analysis reports CWE 296 (Improper Following of a Certificate's Chain of Trust) when a chain of trust is incomplete or not in order (e.g. when the intermediary certificate would be the root as opposed to a trusted CA). The concern is that a web browser might be grabbing the wrong intermediate certificate which might make Man-in-the-Middle attacks easier if an attacker would be able to provide their own certificate.
If the certificate is self-signed, ensure that all clients that connect to this server have the authority's public certificate added to their certificate store. Moreover, ensure that self-signed certificates are only used for internal testing purposes and are never deployed to a production site.
If you would like to discuss this finding in a bit more detail, I would recommend scheduling a consultation. The following Knowledge Article describes how to do this: https://community.veracode.com/s/article/How-to-schedule-a-consultation-call .
Thank you,
Florian Walter