1

First off I have NO idea what ciphers are and my knowledge is very basic in security!

With that said, from this tutorial I have established a secure SSL site and I have a ran a test on my domain and although the rating is A+ but I noticed that TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) is WEAK I don't think this is an important issue but since everything is perfect it looks good if I strongify this cipher too.

would anybody kindly help me fix this weak cipher?

  • 1
    No fix, remove from the list of available cyphers from your server – schroeder Apr 17 '17 at 22:53
4

If following that guide you used this line in your nginx configuration:

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

You should replace that line with

ssl_ciphers '-ALL:EECDH+aRSA+AESGCM:EDH+aRSA+AESGCM:EECDH+aRSA+AES:EDH+aRSA+AES';

then restart nginx and try the Qualys test again (click on clear cache on the Qualys test page if necessary). You can compare the results for the simulated connections by different browsers and search engines to see that nothing changed except you lost the ability of Internet Explorer on Windows XP to connect. That is not a loss, it's completely insecure.

In the future, when you upgrade from Ubuntu 14.04 to a server OS that ships with a version of openssl that supports ChaCha20Poly1305, you'll wany to adjust the ssl_ciphers. This can be as soon as when Ubuntu 18.04 is released a year from now. You'll definitely need to adjust when you switch to Ed25519 certificates, which will take a few years (RSA 2048 certificates will probably be supported for a very long time, and Ed25519 will not become available for at least a year, but eventually everyone will upgrade).

  • +1 Thanks, that fixed the problem, that ships with a version of openssl that supports ChaCha20Poly1305, you'll wany to adjust the ssl_ciphers. How can I know if the OS supports ChaCha20Poly1305 and what would the ssl_ciphers look like then? – dariush Apr 18 '17 at 5:49
  • 1
    @dariush run openssl ciphers -v ECDHE-RSA-CHACHA20-POLY1305, if you get ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD then you have chacha20/poly1305, if you get an error then you don't. If you do, you can use ssl_ciphers '-ALL:EECDH+aRSA+AESGCM:ECDHE-RSA-CHACHA20-POLY1305:EDH+aRSA+AESGCM:EECDH+aRSA+AES:EDH+aRSA+AES';. The value of ssl_ciphers in nginx conf can be an argument to openssl ciphers -v command to test its meaning. The format is complicated: wiki.openssl.org/index.php/Manual:Ciphers(1)#CIPHER_LIST_FORMAT – Z.T. Apr 18 '17 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.