Forum Discussion
san_239682
Nimbostratus
NimbostratusWeak SSL cipher vulnerability during website vulnerability test
During a website vulnerability test we have found threat as:
RC4 contains several known weaknesses, and cipher suites that use RC4 are considered "weak ciphers".Therefore, the following has been id...
ekaleido_26616
Cirrocumulus
CirrocumulusNavigate to the client side SSL profiles you use. Within the Configuration section of each, change the dropdown box from Basic to Advanced. You will see a cipher suites field with the entry "DEFAULT".
I recommend you change it to the following:
ECDHE+AES-GCM:ECDHE+AES:DEFAULT:!TLSv1:!DHE:!RC4:!MD5:!EXPORT:!LOW:!SSLv2
I also recommend adding the following iRule to all of your SSL VIPs as it will help you score an A or better on a Qualys SSL Labs scan:
when HTTP_RESPONSE {HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains"}
san_239682Thank you Ekaleido Just to confirm !TLSv1 disables using the version TLSv1 on SSL profile right?- ekaleido_26616Ye it does, but it still allows 1.1 and 1.2.
- san_239682Is this vulnerability associated only with using TLSV1 or with any other issues
- ekaleido_26616Only TLSv1. 1.1 and 1.2 are good.
