Cipher Suites settings wrong order?

Question

I'm trying to setup a custom order of TLS cipher suites according to this Microsoft list, on Windows Server 2022 but the outcome is not the one that I was expecting.

After using the powershell to disable a bunch, and set a preferred order this is what I have:

PS C:\Windows\system32> Get-TlsCipherSuite | Format-Table -Property CipherSuite, Name

CipherSuite Name

---

   4866 TLS_AES_256_GCM_SHA384
   4865 TLS_AES_128_GCM_SHA256
      0 TLS_CHACHA20_POLY1305_SHA256
      0 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  49195 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  49200 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  49199 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    159 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
    158 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

On the other machine, if I check the Windows host what are the cipher suites in use, the output list is shorten, not displaying all the TLS 1.2 that I set. The missing ones are:

1. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
2. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
3. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
4. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

And here is the output from OpenSSL

sslscan somedomain.com Version: 2.0.15-static OpenSSL 1.1.1q-dev xx XXX xxxx

Connected to 111.111.25.10

Testing SSL server somedomain.com on port 443 using SNI name somedomain.com

SSL/TLS Protocols:

• SSLv2 disabled
• SSLv3 disabled
• TLSv1.0 disabled
• TLSv1.1 disabled
• TLSv1.2 enabled
• TLSv1.3 enabled

TLS Fallback SCSV: Server does not support TLS Fallback SCSV

TLS renegotiation: Session renegotiation not supported

TLS Compression: Compression disabled

Heartbleed:

• TLSv1.3 not vulnerable to heartbleed
• TLSv1.2 not vulnerable to heartbleed

Supported Server Cipher(s):

• Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253
• Accepted TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253
• Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253
• Preferred TLSv1.2 256 bits ECDHE-ECDSA-AES256-GCM-SHA384 Curve P-384 DHE 384
• Accepted TLSv1.2 128 bits ECDHE-ECDSA-AES128-GCM-SHA256 Curve 25519 DHE 253

Server Key Exchange Group(s):

• TLSv1.3 128 bits secp256r1 (NIST P-256)
• TLSv1.3 192 bits secp384r1 (NIST P-384)
• TLSv1.3 128 bits x25519
• TLSv1.2 128 bits secp256r1 (NIST P-256)

SSL Certificate:

• Signature Algorithm: sha256WithRSAEncryption
• ECC Curve Name: prime256v1
• ECC Key Strength: 128

Is anything else that I have to do in order to have the full list of cipher suites ordered using the powershell command? On the other hand, using the Let's Encrypt Certificate I used the ECDSA P-256 as a CSR signing algorithm but what I see, at least for me, looks odd saying sha256WithRSAEncryption, RSA encryption but no TLS cipher? Totally confused.
Not sure, I am not a crypto engineer but I really appreciate any help on this to make things right in place.

Answer 1

On the other machine, if I check the Windows host what are the cipher suites in use, ...

I have no idea what you do did here exactly, since you do not give any command etc you use. But what you show as missing are the ciphers with RSA authentication, which makes sense since you've used an ECDSA certificate.

sslscan ...Supported Server Cipher(s): ....

This looks to me like this matches what you've configured. It will of course not show any ciphers with RSA authentication since you've used an ECDSA certificate.

... looks odd saying sha256WithRSAEncryption, RSA encryption but no TLS cipher?

This is about the algorithms used by the issuer of the certificate to sign the certificate. It is not about the key in the certificate itself which clearly is ECDSA as shown (ECC Curve Name: prime256v1, ECC Key Strength: 128)