2

I was wondering when running tests using let's Qualys SSL Labs against for example say a cloud based web service and as a result it says that the site is using weak ciphers does that mean that the web service has this suites enabled ? I mean if I have a browser and it has all the weak cipher suites disabled would the test still give a warning because the web service still "supports" this ciphers ?

thanks adam

1 Answer 1

2

The SSLLabs test does not use your browser for testing but their own special client which supports more ciphers than the browser does. This means it looks only at server side problems and not at problems which might only happen when the server is used with your specific browser.
Thus the test will give out a warning about weak ciphers if these are configured on the server even if your browser does not support weak ciphers.

7
  • Thank you @Steffen Ullrich. I see your point. I appreciate it ! One question, is it a high security risk to have weak ciphers configured on server side? I know that I can change the list of supported ciphers on the client that is used to connect to the cloud web service to enforce a more secured connection but would it be STILL a risk to leave weak ciphers enabled on the server ? I mean the web service is publicy evailable, so if one knows the url he/she can open it. The server/ web service is not configurable on my end. Thank you.
    – cyzczy
    Commented Nov 21, 2016 at 14:30
  • Also, from what I've understood without tuning the ciphers on the server itself, SSLLabs will still grade it lower because of supported weak cipher suites.
    – cyzczy
    Commented Nov 21, 2016 at 14:34
  • The risk is in a MitM downgrading the cipher used. To do this the MitM wil intercept the interaction between client and server and when the client tells the server which ciphers he supports the MitM will remove the non vulnerable ones (Or the ones he doesn't want)
    – Mr. E
    Commented Nov 21, 2016 at 14:35
  • SSLLabs checks server side supported ciphers cause the cipher used in a SSL/TLS connection is the higher supported by the client and the server. So, if the server supports SSLv2 and TLSv1.2 for example, and a client supports only SSLv2 the connection will be established using the insecure SSLv2 and not the secure option TLSv1.2. And if a client supports both ciphers it will connect through TLSv1.2
    – Mr. E
    Commented Nov 21, 2016 at 14:48
  • @Mr.E: you mix up ciphers (i.e. DES-CBC3) with protocol versions (SSLv3, TLS 1.2) Commented Nov 21, 2016 at 14:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .