Weak Ciphers Removal

[fmalik]

Hi,

In order to get good grades we have been asked to remove weak ciphers in TLS 1.2 and also add TLS 1.3 in our Production environemnt. But we are affraid if removing weak ciphers make any imapct on application functionality and any compatibility issues with browsers . Please guide how we can get good grades from SSL labs etc also incorporating browsers compaticbilty .

Below is the current status :

and what is required :

[Paulius]

@fmalik If you don't have to have this changed immediately your best option here is to log the User-Agent HTTP header and then validate the ciphers that those browsers use by default. The following URL should help you log what SSL ciphers are being used.

https://support.f5.com/csp/article/K86071030

In conjunction with the above URL you can add in the following so that you can also log the User-Agent associated to those SSL ciphers.

User Agent: [HTTP::header user-agent]

 As an example when you add in User-Agent it would look something similar to the following for the logging line.

log local0. "From IP: [IP::client_addr] - User Agent: [HTTP::header user-agent] - cipher: [SSL::cipher name] - version: [SSL::cipher version]"

If you aren't interested in the client IP address you can remove those pieces as well and only log what you are interested in. You can also reorganize your SSL ciphers on the F5 that are currently used to strongest order if that isn't the default to have a better idea of what each client decides to use. The issue you will have is that some clients will not be able to use any of the ciphers you switch to for this higher rating and you might be forced to use a weaker set of ciphers to allow those users to continue using the website. You cannot have both the highest rating and support all client browsers and you will have to make a decision on forcing the clients to update/upgrade and cut off their access or configuring the ciphers that all your clients can use and taking the weaker score.

[Kai_Wilke]

hi Fmalik,

The "required" Ciphers Spec could be rated as most secure with little down level support.

Slighly more compatible Chiper Specs may still add TLS_ECDHE_RSA_WITH_AES_X_CBC_SHA_X Ciphers for legacy clients, but placed at the very buttom of the Cipher List. The result will be still A+ rating (when combined with HSTS) but with added support for slightly older user-agents.

Below is a cipher spec I'm using on public sites where SSL-Labs rating and support for down-level clients is a concern. Its gets a straight A+ rating...

... and still supports many older user-agents (see below)

The user-agents which are not supported by this cipher spec are listed below...

Cheers, Kai

[Leslie_Hubertus]

@fmalik - while you're in good hands with the MVPs who've replied to you, @Gautam_Venna had a very similar question this week and a reply from another MVP.