2

I was wondering when running tests using let's Qualys SSL Labs against for example say a cloud based web service and as a result it says that the site is using weak ciphers does that mean that the web service has this suites enabled ? I mean if I have a browser and it has all the weak cipher suites disabled would the test still give a warning because the web service still "supports" this ciphers ?

thanks adam

1

The SSLLabs test does not use your browser for testing but their own special client which supports more ciphers than the browser does. This means it looks only at server side problems and not at problems which might only happen when the server is used with your specific browser.
Thus the test will give out a warning about weak ciphers if these are configured on the server even if your browser does not support weak ciphers.

  • Thank you @Steffen Ullrich. I see your point. I appreciate it ! One question, is it a high security risk to have weak ciphers configured on server side? I know that I can change the list of supported ciphers on the client that is used to connect to the cloud web service to enforce a more secured connection but would it be STILL a risk to leave weak ciphers enabled on the server ? I mean the web service is publicy evailable, so if one knows the url he/she can open it. The server/ web service is not configurable on my end. Thank you. – cyzczy Nov 21 '16 at 14:30
  • Also, from what I've understood without tuning the ciphers on the server itself, SSLLabs will still grade it lower because of supported weak cipher suites. – cyzczy Nov 21 '16 at 14:34
  • The risk is in a MitM downgrading the cipher used. To do this the MitM wil intercept the interaction between client and server and when the client tells the server which ciphers he supports the MitM will remove the non vulnerable ones (Or the ones he doesn't want) – Mr. E Nov 21 '16 at 14:35
  • SSLLabs checks server side supported ciphers cause the cipher used in a SSL/TLS connection is the higher supported by the client and the server. So, if the server supports SSLv2 and TLSv1.2 for example, and a client supports only SSLv2 the connection will be established using the insecure SSLv2 and not the secure option TLSv1.2. And if a client supports both ciphers it will connect through TLSv1.2 – Mr. E Nov 21 '16 at 14:48
  • @Mr.E: you mix up ciphers (i.e. DES-CBC3) with protocol versions (SSLv3, TLS 1.2) – Steffen Ullrich Nov 21 '16 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.