1

I have Linux servers, which was reported by IT security team having various obsolete ciphers, and I need to disable them and replace with newer versions if they used by applications. However I stumble, that I can't even find these ciphers. How to do it? For example how to figure out where and what using some ciphers below (actual list is much bigger)?

TLSv1.1:  
    ciphers:  
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A 
    TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A 

TLSv1.2:  
    ciphers:  
    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A 
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A

I used command to list all the ciphers, but it didn't return me ciphers which was listed:

$ openssl ciphers -v | column -t

Linux version of servers with ciphers above:

$uname -r
2.6.32-754.35.1.0.4.el6.x86_64

Disclaimer: I'm new at UNIX.

Comparing reports (left red are bad, right are my list), they even not listed on the right: enter image description here

1
  • Except for the handful of new suites for TLS1.3 (implemented only in OpenSSL 1.1.1 up, which something as obsolete as RedHat 6 probably doesn't have), the suite names in OpenSSL differ from the standard (RFC) names which most other implementations and documentation use; see the man page for [openssl-]ciphers(1) at the heading "CIPHER SUITE NAMES". But only for server application(s) that use OpenSSL; some things, even on RHEL6, do not, particular Java-based things other than Tomcat (or Wildfly) using 'native'/APR. Commented May 13, 2023 at 4:23

2 Answers 2

6

You need to configure the application that uses libssl to implement the TLS protocol. you don't need to configure openssl. For example, if you use Apache httpd webserver or nginx webserver or some mail server etc. See this reputable configuration generator: https://ssl-config.mozilla.org/

1
  • How to find application(s) which use particular cipher, so I can configure them? Commented May 16, 2023 at 19:47
1

You can find the equivalence between the proper RFC name as reported by security and the OpenSSL name (that differs for historical reasons) in the following page: https://wildwolf.name/mapping-openssl-cipher-suite-names-to-rfc-names/

1
  • This is very helpful, initally I thought that server is clean, but it was different names for the same ciphers. Commented May 16, 2023 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .