# WinRM HTTPS TLS Validation

- **URL:** https://hackindex.io/services/winrm/vulnerability-discovery/winrm-https-tls-validation
- **Path:** WinRM > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/winrm/vulnerability-discovery.md)
- **Published:** 2026-03-06
- **Updated:** 2026-03-29

WinRM over HTTPS on 5986 is usually the preferred deployment. The vulnerability work is in the TLS layer: weak protocol support, weak ciphers, broken certificate trust, and name mismatches.

Start by pulling the certificate and handshake details.

```bash
openssl s_client -connect $TARGET_IP:5986 -servername $DOMAIN </dev/null
```

This gives you the server certificate, issuer, validity window, selected cipher, and handshake outcome. You are looking for anything that weakens identity or transport protection:

- expired certificate
- self-signed certificate where enterprise trust is expected
- common name or subject alternative name mismatch
- TLS 1.0 or 1.1 support
- weak ciphers

## WinRM TLS Check: Enumerate Supported Versions and Ciphers

Use Nmap to map the full HTTPS posture.

```bash
nmap -Pn -p 5986 --script ssl-cert,ssl-enum-ciphers $TARGET_IP
# | ssl-enum-ciphers:
# |   TLSv1.0:
# |     ciphers:
# |       TLS_RSA_WITH_3DES_EDE_CBC_SHA
# |   TLSv1.2:
# |     ciphers:
# |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
```

`ssl-cert` surfaces certificate details. `ssl-enum-ciphers` shows what protocol versions and cipher suites the listener accepts.

If TLS 1.0 is enabled or 3DES and static RSA suites are accepted, the service is behind current hardened baselines. That is enough to document even if stronger ciphers also exist.

## Check certificate name and trust expectations

If the certificate does not match the hostname operators actually use, users often bypass warnings. That turns HTTPS into checkbox security.

Inspect the certificate fields directly:

```bash
openssl s_client -connect $TARGET_IP:5986 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
```

What changes your next move:

- If the certificate is self-signed on an internal lab host, note it but weigh the exposure realistically.
- If the certificate is self-signed or mismatched on production admin infrastructure, document it as a trust-model failure.
- If the certificate is expired, operators are likely ignoring validation errors already.

## Confirm the listener is actually WinRM

Do not assume every HTTPS service on 5986 is configured correctly. Confirm it is the WSMan endpoint.

```bash
curl -sk -i https://$TARGET_IP:5986/wsman
```

A 401 or 405 with WinRM-style headers is enough. If the certificate is weak and the listener also advertises Basic authentication, combine both issues in one finding chain because the TLS weakness directly affects credential safety.

## Fast protocol checks with OpenSSL

When you want a quick yes or no on legacy protocol support:

```bash
openssl s_client -connect $TARGET_IP:5986 -tls1 </dev/null
openssl s_client -connect $TARGET_IP:5986 -tls1_1 </dev/null
openssl s_client -connect $TARGET_IP:5986 -tls1_2 </dev/null
```

A successful handshake on `-tls1` or `-tls1_1` is usually enough to call out legacy protocol support.

## What the output changes

If only TLS 1.2 or better is enabled and the certificate is valid:

- HTTPS is probably not the weak point.
- Move to authorization checks and auth method review.

If legacy TLS is enabled:

- Document the protocol and any weak ciphers.
- Check whether WinRM is exposed only internally or across broader network segments.

If the certificate is mismatched, expired, or self-signed in a place where enterprise trust should exist:

- Document user validation bypass risk.
- Re-check whether Basic authentication is also enabled.

## Legacy scanners

> [!WARNING]
> `sslscan` is still useful, but Nmap `ssl-enum-ciphers` and OpenSSL are usually enough for WinRM checks and fit better into standard operator workflows.

```bash
sslscan $TARGET_IP:5986
```

## References

- [ssl-enum-ciphers NSE Script](https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html) - Enumerate TLS versions and ciphers
- [ssl-cert NSE Script](https://nmap.org/nsedoc/scripts/ssl-cert.html) - Extract certificate details
- [openssl-s_client](https://docs.openssl.org/master/man1/openssl-s_client/) - TLS handshake and certificate inspection