cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

How to make strong the weak cipher

Saidur900
Nimbostratus
Nimbostratus

Hi All

Already I have a cipher suite which already assigned. But in SSL Labs I found

Cipher Suites# TLS 1.2 (suites in server-preferred order)

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS128TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS256TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)  ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK128TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)  ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK128TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)  ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK256TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)  ECDH secp256r1 (eq. 3072 bits RSA)   FS   WEAK256TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)  WEAK128TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)  WEAK256TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)  WEAK128TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)  WEAK128TLS_RSA_WITH_AES_256_CBC_SHA (0x35)  WEAK256TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)  WEAK256

 

 

How to make these weak ciphers stronger ...Thanks in Advance.

1 REPLY 1

Fallout1984
Cirrocumulus
Cirrocumulus

Saidur,

 

Here is a suggestion for ciphers to make a cert more secure (ie. to get an "A+" when checked via ssllabs.com😞

 

DEFAULT:!3DES:!DHE:!RC4:!RSA:@STRENGTH

 

And then for the options, disallow:

 

TLSv1, TLSv1.1, SSLv2 and SSLv3.

 

What the "@STRENGTH" option does is prioritize the stronger ciphers. You could add that at the end of your cipher list and that would help, but ideally you want to disallow the weaker ciphers.

 

You can look at the preferred cipher list and order that a setting will give you by logging into your F5 via the CLI and entering this command (using DEFAULT:!3DES:!DHE:!RC4:!RSA:@STRENGTH as an example):

 

tmm --clientciphers 'DEFAULT:!3DES:!DHE:!RC4:!RSA:@STRENGTH'

 

Hopefully, this helps.

Alan