TRANSPORT & PKI REVIEW

Transport & PKI Review

Transport is where harvested traffic becomes a future problem, and where most estates hold the least accurate map. A Transport & PKI Review establishes what your terminators actually negotiate, which chains they present, who issued them, and when each one expires. We follow the trust path from leaf certificate to internal root, including the authorities nobody has renewed an owner for. The result is a scored view of the transport layer that a platform team can act on and an auditor can read.

Request a demo The Theos Method

Scope

In scope, and not in scope

In scope

X.509 chains as presented: leaf, intermediates, roots, key types, key sizes, signature algorithms and validity windows.
Certificate issuance paths, including internal certificate authorities, automated issuance, and material issued outside any documented process.
TLS terminators, load balancers, reverse proxies, service meshes and API gateways, reviewed by negotiated result rather than by configuration file.
Cipher suites and key exchange: what is offered, what is preferred, what is negotiated in practice, and which protocol versions remain reachable.
Mutual TLS between services: client certificate inventory, rotation behaviour, and what happens to the trust path when an intermediate is replaced.
Expiry exposure: which certificates lapse first, which are pinned, and which renewals need a change window rather than a script.

Not in scope

Penetration testing. We read what a terminator presents and negotiates; we do not attempt to defeat it.
Web application firewall tuning, denial-of-service resilience, and traffic-filtering policy generally.
Cloud security posture management. A public storage bucket is a real finding and it is somebody else's engagement.
Identity governance and access management policy. We review certificate-based machine identity, not human entitlement.
Key recovery. If material is lost we cannot reconstruct it, and we will not attempt to.
Anything on a public blockchain. No on-chain signatures, no address scanning, no contract review.

Surfaces

What we look at

01
Terminators and negotiated results
Every point where TLS terminates, and the suite, curve and protocol version actually agreed there. Configuration is evidence of intent; the handshake is evidence of behaviour.
02
Chains and trust anchors
The full path from leaf to root, the trust stores that accept it, and any anchor still trusted long after the reason for trusting it retired.
03
Issuance and renewal
How certificates are requested and issued, which paths are automated, and where a human still generates material by hand outside the inventory.
04
Internal certificate authorities
CA hierarchy, key protection, algorithm choices baked in at root creation, and the practical cost of changing any of them.
05
Service-to-service authentication
Mutual TLS deployments, client certificate lifetimes, rotation behaviour under load, and the blast radius of a failed intermediate swap.
06
Expiry and change cost
An ordered view of what lapses first, and for each item whether renewal is a routine job or a coordinated change across several teams.

Scoring

How it is scored

Findings are scored under the Theos Method across its five dimensions: Primitive Fragility, Confidentiality Horizon, Reachability, Change Cost and Substitution Gap. Transport tends to score high on Reachability, because an internet-facing terminator is available to anyone, and high on Confidentiality Horizon wherever the traffic carries records that stay sensitive for decades. Substitution Gap is what separates two otherwise identical findings: a terminator you control can be re-keyed, and an appliance whose vendor has shipped no post-quantum support cannot. The weights are published on the methodology page and are not repeated here.

Read the method specification

Deliverables

What you receive

01
Primary artefact
Exposure Register (CSV)
CSV, one row per asset
Every certificate, terminator and negotiated suite in scope, with its classification, score, tier and expiry date in one sortable file.
02
Posture Attestation
Signed attestation, reference format TQ-PA-YYYY-XXXXXX
The signed record that the transport scope was assessed on a named date under a named method version, checkable at Attestation Lookup.
03
Remediation Sequencing Plan
PDF with a CSV work-item export
The order in which to re-key, re-issue and reconfigure, driven by expiry dates and change cost rather than by score alone.
04
Evidence Pack
Archive with a sha256 manifest
Handshake captures, chain dumps and configuration snapshots behind each finding, hashed so a reviewer can confirm what was observed.
05
CBOM (CycloneDX)
CycloneDX JSON
The transport slice of the cryptographic bill of material, mergeable with an existing estate-wide CBOM instead of replacing it.

Evidence

Evidence and reproducibility

theos-method-v1.0

Each finding records the endpoint or store it came from, the observation that produced it, and the timestamp of that observation, because a negotiated suite is only true as of a moment. Scores are pinned to theos-method-v1.0, and the version is carried in every export so a figure quoted in a board pack can be traced back to the rules that produced it. A reviewer who wants to repeat the work rather than trust it should follow Reproducing our numbers.

Reproducing our numbers

Inputs

Inputs and duration

Duration: [PLACEHOLDER: engagement duration, Transport & PKI Review]
Scope you nominate: The hostnames, terminators, service meshes and certificate authorities in scope, agreed in writing before we begin.
Access we need: Read-only access to certificate inventories, terminator configuration, and a non-production environment representative of production.
People we need: The platform or network owner, whoever operates the internal CA, and one application owner for each externally reachable service.
What we never ask for: Private keys, certificate signing authority, production credentials, or any ability to change a live configuration.
Handover: A walkthrough of the sequencing plan with the teams who own the renewals, before the first change window is booked.

Questions

Questions we are asked

Do you test our endpoints from the internet: We observe what a terminator presents and negotiates, from a source and window you agree in advance. That is an observation, not an intrusion test, and it stops well short of attempting to defeat anything.
We already have certificate lifecycle management. What does this add: Lifecycle tooling tracks what it was told about. This review finds material outside it, records the algorithms and key sizes behind each chain, and scores what a break or a lapse would cost. Expiry management and exposure scoring are different questions.
What this engagement will not tell you: It will not tell you that your transport layer is safe, and it will not date the moment a given key exchange stops being adequate. It reports what is deployed, how exposed it is under a published method, and what replacing it would take. Adequacy against a specific regulator's expectation is a separate judgement, and we will say where that judgement sits with your assessor rather than with us.
How do you treat hybrid key exchange: As a transitional posture with a stated benefit and a stated cost. We record where hybrid modes are already available in your stack, what they negotiate, and what breaks when a peer does not support them.
Which standards do you map findings to: NIST FIPS 203 for key establishment, with FIPS 204 and 205 where certificate signature algorithms are in question, alongside the published CNSA 2.0 timeline for federal-facing systems.

Three articles that go further

Discuss this engagement

Tell us the estate you have in mind and we will walk through what this engagement would cover, what it would produce, and where its boundary sits. If you would rather put questions in writing first, write to us instead.

Request a demo Contact us