From 2d07080b0b085ba24e26908a836d7fb44cc59489 Mon Sep 17 00:00:00 2001
From: "github-agentic-autofix[bot]"
 <314318003+GitHub Agentic Autofix@users.noreply.github.com>
Date: Wed, 28 Oct 2026 05:47:34 +0000
Subject: [PATCH] Require TLS 1.2 for certificate checks

Co-authored-by: technoporada <171401859+technoporada@users.noreply.github.com>
---
 services/network.py   |  1 +
 tests/test_network.py | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/services/network.py b/services/network.py
index 4e3b57c..e817b49 100644
--- a/services/network.py
+++ b/services/network.py
@@ -195,6 +195,7 @@ async def ssl_check(self, domain: str) -> Dict:
 
             def _get_cert():
                 ctx = ssl.create_default_context()
+                ctx.minimum_version = ssl.TLSVersion.TLSv1_2
                 ctx.check_hostname = False
                 ctx.verify_mode = ssl.CERT_NONE
 
diff --git a/tests/test_network.py b/tests/test_network.py
index 3e828ed..4f04681 100644
--- a/tests/test_network.py
+++ b/tests/test_network.py
@@ -4,6 +4,7 @@
 
 import pytest
 import asyncio
+import ssl
 from services.network import NetworkRecon
 
 
@@ -38,3 +39,31 @@ def test_tech_signatures_categories(network):
     assert "CMS" in categories
     assert "Framework" in categories
     assert "Server" in categories
+
+
+@pytest.mark.asyncio
+async def test_ssl_check_requires_tls_12(network, monkeypatch):
+    class FakeSocket:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_):
+            pass
+
+        def getpeercert(self, binary_form):
+            return b"certificate"
+
+    class FakeContext:
+        def wrap_socket(self, sock, server_hostname):
+            return FakeSocket()
+
+    context = FakeContext()
+    monkeypatch.setattr("services.network.ssl.create_default_context", lambda: context)
+    monkeypatch.setattr(
+        "services.network.socket.create_connection", lambda *args, **kwargs: FakeSocket()
+    )
+    monkeypatch.setattr("services.network.ssl.DER_cert_to_PEM_cert", lambda cert: "certificate")
+
+    await network.ssl_check("example.com")
+
+    assert context.minimum_version == ssl.TLSVersion.TLSv1_2