aegis-tls-proxy

Scope & Objectives

Audit, read-only, the TLS-terminating reverse-proxy layer of a Linux host or its config-as-code repository. Determine:

1. Which process owns ports 80/443 and whether it leaks version information.
2. The full virtual-host map and what answers unrecognized Host headers.
3. TLS protocol floor, cipher/curve selection, session handling, OCSP stapling, chain completeness, SAN coverage, and certificate-expiry automation.
4. Edge response headers (HSTS and companions) and the nginx add_header inheritance trap.
5. Request-size and timeout limits at the edge versus what the application actually accepts.
6. Admin-path shielding (/admin, /actuator, /metrics) via CIDR allowlists, basic auth, mTLS, or a separate management vhost.
7. The proxy-to-application hop: transport security and forwarded-header (X-Forwarded-For, Host) trust correctness.
8. ACME/certbot operational hygiene: renewal timers, deploy hooks, rate-limit and challenge-path pitfalls.

Secondary coverage: Caddy automatic-HTTPS model, HAProxy bind-line TLS defaults, Apache SSLProtocol/SSLCipherSuite equivalents, and mod_security as a WAF option.

Out of scope (sibling modules): volumetric denial-of-service defense and rate-limit tuning depth (DOS module), application authorization logic (AUTHZ module), HTTP protocol abuse such as host-header poisoning payloads (code-audit http-protocol module). Every command in What To Check / Where To Look / Exploitation is non-mutating inspection; mutating steps appear only under Remediation and Verification.

Prerequisites & Vocabulary