Arbiter and Sentinel Web API Certificates

The Specops Password Policy Sentinel and Specops Password Arbiter Web APIs use Specops-managed self-signed TLS server certificates. These certificates are validated through certificate pinning, authenticating the server and protecting against man-in-the-middle attacks.

Vulnerability scanners may flag self-signed certificates because they do not chain to a trusted certificate authority. This correctly identifies the certificate type, but does not account for the certificate pinning enforced by Specops. A self-signed certificate finding alone therefore does not demonstrate a man-in-the-middle vulnerability.

Certificate pinning establishes trust in a specific certificate or public key. It is an established security technique suited to controlled environments such as these internal connections, where Specops manages both the client software and server certificates.

Specops public services, including the download site and Breached Password Protection Cloud API, use CA-issued certificates and standard CA-based validation.

Specops automatically manages the certificates for the Sentinel and Arbiter Web API endpoints and uses certificate pinning to validate server identity. This managed configuration is required to maintain the intended trust relationship between Specops components.

If a vulnerability scanner reports a finding based solely on the use of self-signed certificates, that finding should be documented as an expected configuration, with certificate pinning recorded as the server-validation mechanism.