Forum Discussion
Nimbostratusstop cipher TLS_DH_anon_WITH_AES_128_GCM_SHA256
Hello,
How can I stop the following cipher inside SSL profile ? Im not using default cipher im putting instead : TLSv1_2
C:\Users\haberr>nmap --script ssl-enum-ciphers -p 443
Starting Nmap 7.12 ( https://nmap.org ) at 2017-12-08 12:43 Middle East Standar Time Nmap scan report for (192.168.110.110) Host is up (0.0019s latency). PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A | TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A | TLS_DH_anon_WITH_AES_256_GCM_SHA384 - F | TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (dh 1024) - D | TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 1024) - A | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A | TLS_DH_anon_WITH_AES_128_GCM_SHA256 - F | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A | TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A | TLS_DHE_RSA_WITH_DES_CBC_SHA (dh 1024) - D | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (dh 1024) - A | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (dh 1024) - A | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A | compressors: | NULL | cipher preference: server | warnings: | Ciphersuite uses MD5 for message integrity | Key exchange parameters of lower strength than certificate key | Weak cipher RC4 in TLSv1.1 or newer not needed for BEAST mitigation |_ least strength: F
Nmap done: 1 IP address (1 host up) scanned in 2.19 seconds
C:\Users\haberr>
Ashwin_VenkatEmployee
Make sure you disable Anonymous Diffie Hellman key exchange based cipher suites. If you're using TLSv1_2 as the cipher string, you'd want to append :!ADH to your cipher string. Moreover, you'd also want to disable some of the weak block ciphers like RC4, DES and 3DES as well.