Menu
Client certificate authentication should not be used for users (Manual)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-k8s-v1120-3-1-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-k8s-v1120-3.1.1 |
| description | Client certificate authentication should not be used for users (Manual) |
| category | cis-k8s |
| version | 1.12.0 |
| author | cyberstrike-official |
| tags | ["cis","kubernetes","control-plane-config","authentication"] |
| cis_id | 3.1.1 |
| cis_benchmark | CIS Kubernetes Benchmark v1.12.0 |
| tech_stack | ["kubernetes"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose.
It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication.
With any authentication mechanism the ability to revoke credentials if they are compromised or no longer required, is a key control. Kubernetes client certificate authentication does not allow for this due to a lack of support for certificate revocation.
External mechanisms for authentication generally require additional software to be deployed.
Review user access to the cluster and ensure that users are not making use of Kubernetes client certificate authentication.
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates.
Client certificate authentication is enabled by default.
The lack of certificate revocation was flagged up as a high risk issue in the recent Kubernetes security audit. Without this feature, client certificate authentication is not suitable for end users.
None
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.2 Establish an Access Revoking Process | |||
| v7 | 16.7 Establish Process for Revoking Access |
Level 1 - Master Node (Manual)
