TLS endpoint and certificate posture

The honest-empty contract

The TLS posture surface is a read-only API over the same canonical inventory described in Inventory and CBOM. It lists persisted tls_endpoint and certificate assets hydrated from their latest evidence, and never synthesizes rows from findings.

One more rule worth knowing: a certificate observation with no expiry date on record is skipped rather than rendered with a fabricated "expires today". Unknowns are omitted, not invented.

Endpoint posture

GET /api/v1/projects/{projectId}/tls/endpoints returns endpoint posture rows: negotiated TLS versions, preferred TLS 1.2 and 1.3 ciphers, supported key-exchange groups, PQC hybrid groups, HSTS, ALPN, external exposure, plus a derived issues list and highestSeverity.

Filter	Type	Effect
`service_id`	GUID	Only endpoints mapped to this service
`public_exposure`	bool	Only externally exposed, or only internal, endpoints
`pqc_hybrid`	bool	Only endpoints that do, or do not, negotiate a PQC hybrid group
`key_type`	string	Leaf-certificate key algorithm, exact and case-insensitive; endpoints where it is unknown are excluded when set
`signature_algorithm`	string	Leaf-certificate signature algorithm, substring and case-insensitive
`min_severity`	string	`info` \| `low` \| `medium` \| `high` \| `critical`

How issues are derived

Issues are derived only from observed posture — never fabricated, never assumed from a version string alone.

Observation	Issue code	Severity
TLS 1.0 supported	`weak_tls_version`	critical
TLS 1.1 supported	`weak_tls_version`	high
RC4, 3DES, DES, NULL, EXPORT, or anonymous cipher negotiated	`weak_cipher`	critical
CBC-mode cipher negotiated	`weak_cipher`	medium
Externally exposed endpoint with no PQC hybrid group	`no_pqc_hybrid`	medium

Certificate inventory

GET /api/v1/projects/{projectId}/tls/certificates returns certificate rows: subject, issuer, key algorithm and size, signature algorithm, the validity window, a computed daysUntilExpiry, self-signed and OCSP-stapling flags, and the endpoint the certificate was observed on.

Filter	Type	Effect
`service_id`	GUID	Only certificates mapped to this service
`public_exposure`	bool	Filter by the associated endpoint exposure
`expires_within_days`	int	Only certificates expiring within N days
`expired`	bool	Only already-expired, or only unexpired, certificates
`key_type`	string	Key algorithm, exact and case-insensitive
`signature_algorithm`	string	Signature algorithm, substring and case-insensitive
`pqc_hybrid`	bool	Parity filter, applied only when the endpoint posture is resolvable

Where TLS posture surfaces in the UI

The External TLS exposure table on the Security dashboard — one row per endpoint with Endpoint, Exposure, Severity, Issues, TLS versions, and PQC columns, plus a header legend counting critical, high, and PQC-ready endpoints. When nothing has been ingested it honestly reads "No TLS endpoints have been probed yet."
Two KPI tiles — External weak TLS and Certs expiring ≤30d — computed from the same responses.

Recognized PQC hybrid groups

Group	Status
`X25519MLKEM768`	Recommended — the mainstream hybrid transition group
`SecP256r1MLKEM768`	Supported
`SecP384r1MLKEM1024`	Supported, higher security category
`X25519Kyber768Draft00`	Flagged as a stale draft codepoint — migrate to `X25519MLKEM768`

Assessing TLS posture locally

If your tenant TLS inventory is not populated yet, you do not have to wait for a connector. The relixq CLI probes endpoints directly, and its findings flow through the same pipeline.

console

relixq scan tls example.com:443
relixq scan tls --targets hosts.txt --format sarif --exit-on high

The probe flags quantum-vulnerable certificate keys, undersized RSA keys, SHA-1 signatures, expired or soon-to-expire certificates, self-signed leaves, deprecated TLS 1.0 and 1.1, and weak negotiated cipher suites. It observes the handshake only and never sends application data. Full flags in the CLI reference.