cwe-295-insecure-tls-trust-manager

name: cwe-295-insecure-tls-trust-manager description: Use this skill when you need to remediate CWE-295 (Insecure TLS/SSL Configuration) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing insecure tls/ssl configuration issues. version: 1.0.0 license: MIT tags:

• security
• java
• cwe-295
• remediation
• sast

CWE-295 Insecure TLS/SSL Configuration

Description

Insecure TLS/SSL Configuration

Reference: https://cwe.mitre.org/data/definitions/295.html

OWASP Category: A02:2021 – Cryptographic Failures

Vulnerable Pattern

❌ Example 1: Vulnerable Pattern

// VULNERABLE: TrustManager that accepts ALL certificates
TrustManager[] trustAllCerts = new TrustManager[] {
    new X509TrustManager() {
        public void checkClientTrusted(X509Certificate[] certs, String authType) {}
        public void checkServerTrusted(X509Certificate[] certs, String authType) {}  // EMPTY!
        public X509Certificate[] getAcceptedIssuers() { return null; }
    }
};
SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new SecureRandom());

// VULNERABLE: HostnameVerifier that accepts all
HostnameVerifier allHostsValid = (hostname, session) -> true;  // DANGEROUS!

Why it's vulnerable: This pattern is vulnerable to Insecure TLS/SSL Configuration

Deterministic Fix

✅ Secure Implementation: Secure Implementation

// SECURE: Use default system trust store
SSLContext sc = SSLContext.getDefault();

// Or create with default TrustManager
SSLContext sc = SSLContext.getInstance("TLSv1.3");
TrustManagerFactory tmf = TrustManagerFactory.getInstance(
    TrustManagerFactory.getDefaultAlgorithm());
tmf.init((KeyStore) null);  // Uses default system trust store
sc.init(null, tmf.getTrustManagers(), new SecureRandom());

// SECURE: Use default hostname verifier
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setHostnameVerifier(HttpsURLConnection.getDefaultHostnameVerifier());

// If custom trust store needed, load it properly
KeyStore trustStore = KeyStore.getInstance("JKS");
trustStore.load(new FileInputStream("truststore.jks"), "password".toCharArray());
tmf.init(trustStore);

Why it's secure: Implements proper protection against Insecure TLS/SSL Configuration

Detection Pattern

Look for these patterns in your codebase:

# Find custom TrustManagers
grep -rn "X509TrustManager\\|checkServerTrusted" --include="*.java"

# Find HostnameVerifier overrides
grep -rn "HostnameVerifier.*->.*true" --include="*.java"

Remediation Steps

1. Remove custom TrustManagers with empty check methods

2. Use SSLContext.getDefault() for standard TLS

3. Use TLSv1.2 or TLSv1.3 (never SSLv3 or TLSv1.0)

4. Keep default HostnameVerifier

Key Imports

import javax.net.ssl.SSLContext;

import javax.net.ssl.TrustManagerFactory;

Verification

After remediation:

• Run SAST scanner to confirm vulnerability is resolved

• Review all instances of the vulnerable pattern

• Add unit tests that verify the secure implementation

• Check for similar patterns in related code

Trigger Examples

Fix CWE-295 vulnerability
Resolve Insecure TLS/SSL Configuration issue
Secure this Java code against insecure tls/ssl configuration
SAST reports CWE-295

Common Vulnerable Locations

| Controller | *Controller.java | User input handling |

| Service | *Service.java | Business logic |

| Repository | *Repository.java | Data access |

References

• CWE-295: Improper Certificate Validation

Source: Generated by Java CWE Security Skills Generator Last Updated: 2026-03-07