TS37Performance and deployment
Performance and deploymentDoes HTTPS work across the whole chain?
HTTPS, HSTS and embedded resources create neither certificate errors nor mixed content.
Prepare evidence
- In the app
- Evidence import
- You provide
- Certificates, responses and resources
- Allow for
- Depends on evidence needed
In the app
You provide
Allow forUnderstand
An HTTPS connection. Right down to the resources.
HTTPS, HSTS and embedded resources create neither certificate errors nor mixed content.
TSEP protocol criterion
TSEP examines HTTPS delivery within the declared scope. The result does not replace a general security audit or access-rights review.
The rules and limits of this check are detailed at the bottom of this guide.
Check
From the certificate. To the resources.
In TSEP Control
You import evidence for this control. The engine assesses it within the declared scope; missing items remain visible.
Your contribution
Define the scope and expectations before collection. Gather the items below and supply the requested reviews.
With your own tools
With your own toolsCheck the certificate and trust chain in the browser, then inspect redirects and HTTP resources. Record HSTS and its scope before changing affected subdomains.
Evidence to retain
Archived certificates and HTTP chains, reviewed mixed resources, explicit HSTS decision and documented scope.
What this result covers
HSTS strengthens transport after the policy is received; it fixes neither an invalid certificate nor a poor URL architecture.
Act
Repair the chain. Check its scope.
Fix certificate errors and mixed content; examine HSTS scope before changing it.
Recheck
The same hosts. The same resources.
After correction, gather new evidence with the same scope and expectations. Retain both dated observations to compare what changed.
To go further.
Statuses, sources and method.
Understand the statusesC · NC · NT · NA
The same legend in guides, analysis and demo. Each status depends on the control’s evidence and rules.
- C · Verified
- The criterion is met within the assessed scope. Keep dated evidence for the next comparison.
- NC · To correct
- Fix certificate errors and mixed content; examine HSTS scope before changing it.
- NT · Not established
- Evidence or confirmations are insufficient to conclude. Supply what is missing; this status does not establish an SEO error.
- NA · Not applicable
- The control does not apply to the scope under its rules, with a retained justification. Missing evidence alone does not make it non-applicable.
Sources and references1 reference
Detailed method and rules3 rules
Control method and criteria
Method
Test certificates on public hosts, follow HTTP/HTTPS variants, record Strict-Transport-Security and find HTTP subresources.
Acceptance criteria
Certificates and redirects are valid for tested hosts; mixed content is reviewed; the HSTS decision and scope are documented without requiring preload.
Non-applicability
No relevant public HTTP service.
Detailed rules
TS37-A01 · Certificates, host, time and supplied trust
Protocol assessment mode : assisted, with supplied evidence and declarations. App availability is shown on the control card.
Scope
Prior finite TS37 population under render-transport-v1; see docs/render-transport-evidence.md.
Evidence
Exact originals, plan and dates/context, fingerprints, diagnostics and reasoned review bound to the entire dossier. Kinds: tls, intent.
Method
Recheck supplied public PEMs with offline OpenSSL3: chain, server purpose, DNS host, supplied time and explicit supplied roots. Disable implicit stores; retain version and diagnostic.
Acceptance criteria
Profile verification succeeds under supplied roots. A supported X509 error, including expiry or wrong host, fails.
When the result remains inconclusive
Missing OpenSSL3, unusable PEM, misattributed capture, absent roots or unqualified error code: NT.
Non-applicability
No atomic NA. Empty population or claimed absent domain without evidence remains NT in this profile.
Assumptions
Supplied unauthenticated provenance, inventory, browser state, conditions and judgment; two static HTML readings are not two navigations. TLS trust depends on supplied roots.
Limitations
No real audit inferred from synthetic cases. No indexing, ranking, global conformity, accessibility certification, exhaustive security or universal browser trust. Reviews may be wrong and captures may omit states.
TS37-A02 · HTTPS redirects and HSTS decision
Protocol assessment mode : assisted, with supplied evidence and declarations. App availability is shown on the control card.
Scope
Prior finite TS37 population under render-transport-v1; see docs/render-transport-evidence.md.
Evidence
Exact originals, plan and dates/context, fingerprints, diagnostics and reasoned review bound to the entire dossier. Kinds: http, configuration, intent.
Method
Follow the supplied HTTP chain to HTTPS without downgrade, check direct200 response, compare HSTS configuration and header with planned enablement, max-age, subdomains, scope, owner and rationale.
Acceptance criteria
Chains and HSTS decision agree; HSTS may be explicitly disabled. No preload requirement.
When the result remains inconclusive
Missing chain/configuration, ambiguous header, absent scope or decision: NT.
Non-applicability
No atomic NA. Empty population or claimed absent domain without evidence remains NT in this profile.
Assumptions
Supplied unauthenticated provenance, inventory, browser state, conditions and judgment; two static HTML readings are not two navigations. TLS trust depends on supplied roots.
Limitations
No real audit inferred from synthetic cases. No indexing, ranking, global conformity, accessibility certification, exhaustive security or universal browser trust. Reviews may be wrong and captures may omit states.
TS37-A03 · Embedded resources and mixed traffic in scope
Protocol assessment mode : assisted, with supplied evidence and declarations. App availability is shown on the control card.
Scope
Prior finite TS37 population under render-transport-v1; see docs/render-transport-evidence.md. Amendment: docs/render-transport-prerequisites-v2.md.
Evidence
Exact originals, plan and dates/context, fingerprints, diagnostics and reasoned review bound to the entire dossier. Kinds: http, render, intent.
Method
Bind HAR and console to the HTTPS document; inspect observed requests and source embedded URLs. The strict profile requires HTTPS for these resources even when a browser might upgrade them. With unqualified base href, a relative URL stays NT; examine absolute URLs independently despite CSS/srcset or another unknown scheme.
Acceptance criteria
No HTTP URL observed on these surfaces; dynamic-coverage review retained. An observed native HTTP URL fails despite another gap.
When the result remains inconclusive
Truncated HAR, missing body, unqualified CSS/srcset, incomplete context or absent review: NT. Unqualified relative resolution with base href: NT; an independent HTTP contradiction stays NC.
Non-applicability
No atomic NA. Empty population or claimed absent domain without evidence remains NT in this profile.
Assumptions
Supplied unauthenticated provenance, inventory, browser state, conditions and judgment; two static HTML readings are not two navigations. TLS trust depends on supplied roots.
Limitations
No real audit inferred from synthetic cases. No indexing, ranking, global conformity, accessibility certification, exhaustive security or universal browser trust. Reviews may be wrong and captures may omit states.
Rule version 0.3.0-draft.5 · Public protocol reference · Versioned source
Put it into practice
Certificates, responses and embedded resources.