A VA/PT report shows the following for my PKI:

The SSL service permits the use of one or more anonymous ciphers, which an attacker may take advantage of via a man in the middle attack. The anonymous ciphers should be disabled.

What does it mean and how do I mitigate it?


Since your question is very vague, I can but guess.

Anonymous cipher means, that the key exchange happens without any authentication taking please, meaning the no (server) certificate is used in the process. But without any authentication, the DH key exchange can easily be attacked by a MitM.

To mitigate this, you have to reconfigure your server software, whatever it may be. Look for the configuration setting where you can enter the allowed cipher suites. if you just want to get rid of the anonymous cipers, you must only disallow the DH_ANON mechanism. Preferably it would be, to put in a whitelist of acceptable cipher suites.

A good guide for the specific settings of popular server software plus a list of acceptable cipher suites is provided by the friendly people of bettercrypto

  • 1
    Choice of SSLv3 and SSLv2 vs. TLS 1.x are unrelated to use of anonymous ciphers – Steffen Ullrich Nov 3 '16 at 10:34
  • I put it there, because I found it a sensible thing to do, since he has to update his server configuration anyway. But you are correct of course, it doesn't really matter for the question asked. I removed that part. – mat Nov 3 '16 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.