0

I have an API hosted on Amazon API Gateway. When running a security scan of it using https://www.ssllabs.com/ it reports back warnings concerning weak cipher suites for TLS 1.2 (see below).

Are these warnings a valid concern and if so how can I mitigate them?

enter image description here

Improve this question
1
  • 1
    "Are these warnings a valid concern" - depends on your specific threats and risks. "and if so how can I mitigate them?" - I cannot find anything in the documentation for this. When in doubt contact AWS support.
    – Steffen Ullrich
    Commented Aug 27, 2021 at 7:09

1 Answer 1

Reset to default
1

With AWS API Gateway you can only choose between TLS 1.0 and upwards, and TLS 1.2 and upwards. Depending on which option you go for, you will have to rely on related cipher suite list which you won't be able to modify - link. If I can see correctly in your screenshot you already went with TLS 1.2 and upwards, much more secure choice.

What's pointed out on the report as weak, are the cipher suites which meet at least one of the following conditions:

  • Don't use authenticated encryption - of those listed, only AES-GCM and ChaCha20-Poly1305 do.
  • Don't offer forward secrecy, i.e. use RSA for key exchange.
  • Message digest older than SHA-2.

This might be a significant oversimplification, however you can think of the output of the report as of the summary of deviations from TLS 1.3 spirit.

Should that worry you? TLS 1.2 is not deprecated yet. Unless you have strict requirements e.g. to stick to TLS 1.3 or limit list of supported cipher suites, I wouldn't say you have a big problem to solve right now.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .