Forum Discussion

mkumar1113_2457's avatar
mkumar1113_2457
Icon for Nimbostratus rankNimbostratus
Mar 02, 2019

Security check for F5 URL

Following issues related to F5 URL are observed at multiple places during security scan.

 

  1. Critical : Insecure Transport: Insufficient Diffie Hellman Strength, ID 80641927 : https://services-stg-oauth.cummins.com:443/atlasmobile/services?call=AtlasLogin-v3
  2. High: Insecure Transport: Weak SSL Protocol, ID 80641930 : https://services-stg-oauth.cummins.com:443/atlasmobile/services?call=AtlasLogin-v3
  3. Medium: Insecure Deployment: OpenSSL , ID 80641928 : https://services-stg-oauth.cummins.com:443/atlasmobile/services?call=AtlasLogin-v3
  4. Medium: Insecure Transport: Weak SSL Protocol, ID 80641929 : https://services-stg-oauth.cummins.com:443/atlasmobile/services?call=AtlasLogin-v3

Also review the following SSL check that I ran on SSLLabs.com. Getting a B rating on the same :

 

https://www.ssllabs.com/ssltest/analyze.html?d=services-stg-oauth.cummins.com

 

Requesting you to look into this issue and let us know when it can be resolved.

 

application delivery
BIG-IP
  • Michael_Saleem's avatar
    Michael_Saleem
    Icon for MVP rankMVP
    Mar 02, 2019

    Hi,

     

    The SSL labs report indicate you are using weak DH params (1024 bits)

     

    I am assuming that you are terminating SSL on the F5 virtual server. To resolve this in the client SSL profile applied to the virtual server, disable DHE (but keep ECDHE enabled). It would also be a good idea to prioritise ECDHE so that it is at the top of the cipher suite preference order.