Atlas / Skills / cyberstrikeus / Cis Nginx V300 4 1 11

Cis Nginx V300 4 1 11CAUTION

skills/cyberstrikeus/cis-nginx-v300-4-1-11

Agent skill by cyberstrikeus · agents · ai hacking · ai penetration testing · Audited 2026-10-18

⚑ Report / re-scan Source ↗

Open-source AI-powered offensive security harness for automated penetration testing.

Verdict

CAUTION

Grade

Trust score

89 /100

Version

3.0

Hosts

—

License

AGPL-3.0

Stars

3,185

Overview

Open-source AI-powered offensive security harness for automated penetration testing.

Read from source at commit eaf7d03223fcOBSERVED · 2026-10-18

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cis-nginx-v300-4-1-11
description: "Ensure Secure Session Resumption is Enabled (Manual)"
category: cis-nginx
version: "3.0"
author: cyberstrike-official
tags: [cis, nginx, web-server, reverse-proxy, tls-ssl, encryption]
cis_id: "4.1.11"
cis_benchmark: "CIS NGINX Benchmark v3.0.0"
tech_stack: [nginx, linux, web-server]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS 4.1.11 — Ensure Secure Session Resumption is Enabled

## Profile Applicability

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

## Description

TLS 1.3 introduces a secure session resumption mechanism using **P**re-**S**hared **K**eys (PSKs) that significantly improves performance for returning clients by reducing the handshake latency. This modern mechanism should be enabled to enhance user experience without compromising security.

## Rationale

Unlike older TLS versions, the TLS 1.3 resumption mechanism preserves **P**erfect **F**orward **S**ecrecy (PFS). It accomplishes this by combining the PSK with a **fresh** Ephemeral Diffie-Hellman key exchange (ECDHE) for **every** resumed session. This ensures that a compromise of the resumption key does not compromise any past or future session keys. Disabling this feature provides no security benefit and negatively impacts performance.

## Impact

Enabling session resumption has a positive performance impact. There are no significant negative security implications when using a TLS 1.3-only configuration.

## Audit Procedure

Run the following command to verify that `ssl_session_tickets` **is not** explicitly turned `off`.

```bash
# This command should produce NO output.
grep -ir "ssl_session_tickets" /etc/nginx/ | grep -i "off"
```

If the command produces any output containing `ssl_session_tickets off;`, this recommendation is not implemented.

## Remediation

Ensure that `ssl_session_tickets` is not set to `off`. The recommended approach is to remove the directive entirely, as the default value is `on`.

If the directive is present, either remove it or set it to `on`:

```nginx
# REMOVE this line from your configuration:
# ssl_session_tickets off;

# OR, if you want to be explicit, ensure it is set to ON (optional):
ssl_session_tickets  on;
```

## Default Value

`ssl_session_tickets` is enabled (`on`) by default. This is the desired and secure state for TLS 1.3.

## References

1. https://datatracker.ietf.org/doc/html/rfc8446
2. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
3. https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/

## CIS Controls

| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.10 Encrypt Sensitive Data in Transit            | N    | Y    | Y    |
| v7               | 14.4 Encrypt All Sensitive Information in Transit | N    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic            | Technique                       |
| ----------------- | ------------------------------- |
| Credential Access | T1557 - Adversary-in-the-Middle |

## Profile

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	NA
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found