# SEC09-BP01: Implement secure key and certificate management

## Description

TLS 1.2+.

## Implementation Guidance

- TLS 1.2 minimum, prefer 1.3
- Automated certificate management
- Certificate rotation
- Strong cipher suites
- HSTS enabled

## Risk Level

High - Weak TLS is easily broken.
