middle.network
Health check
Guide for auditors

TLS and certificate evidence for ISO 27001 A.8.24 and SOC 2 CC6.7

Protocol versions, certificate management and HSTS: what to check and what to ask for.

Auditors and security engineers6 min readUpdated

What the control asks

A.8.24 asks for rules on the effective use of cryptography, including key management, to be defined and implemented. SOC 2 CC6.7 asks that data in transmission is protected. For a public website or mail server, the visible part is TLS: which versions are offered, which certificate is presented and how it’s managed.

Check these four things

  • Protocol versions: TLS 1.2 and 1.3 only. TLS 1.0 and 1.1 were formally deprecated in 2021 (RFC 8996) and fail PCI DSS.
  • Certificate validity: issued for the right names, chain complete, not expired, and not expiring within 14 days.
  • Renewal: public certificates are moving to shorter lifetimes (200 days from March 2026, falling to 47 days by 2029), so renewal must be automated. Ask how it is done.
  • HSTS: a Strict-Transport-Security header so browsers never fall back to plain HTTP.

Certificate transparency is free evidence

Every publicly trusted certificate is logged in certificate transparency logs. Searching them shows every certificate issued for a domain: which authorities issued them, when, and for which subdomains. Certificates from an unexpected issuer, or for subdomains nobody recognises, are worth a question.

Tip: A CAA record in DNS limits which certificate authorities may issue for the domain. It’s a one-line record and a clean piece of evidence for key management.

Questions to ask

  • Who is responsible for certificates, and is there an inventory of them?
  • How are certificates renewed, and what alerts fire before expiry?
  • Is there a documented minimum TLS version, and is it enforced on every public endpoint, including mail?

Don’t forget mail

Web TLS is usually fine; mail TLS often isn’t checked at all. Look for STARTTLS on every MX host and an MTA-STS policy in enforce mode. Together they show mail between organisations is encrypted too.

This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.

More guides

ISO 27001:2022 evidence you can collect from outside the network Which Annex A controls leave a trace on the internet, and how to evidence them in ten minutes. 8 min read · ISO 27001 auditors and ISMS owners
Auditing email authentication: SPF, DKIM and DMARC explained for auditors What each record proves, the five findings that matter, and the questions to ask. 7 min read · Auditors, GRC teams, IT managers
The ten-minute external security review: a checklist for auditors A repeatable outside-in review of any organisation’s domain, with what to record. 6 min read · Auditors and third-party risk teams
DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy The domain itself is an asset. How to check it is owned, protected and resilient. 6 min read · Auditors and IT managers