1

I have Linux servers, which was reported by IT security team having various obsolete ciphers, and I need to disable them and replace with newer versions if they used by applications. However I stumble, that I can't even find these ciphers. How to do it? For example how to figure out where and what using some ciphers below (actual list is much bigger)?

TLSv1.1:  
    ciphers:  
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A 
    TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A 

TLSv1.2:  
    ciphers:  
    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A 
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A

I used command to list all the ciphers, but it didn't return me ciphers which was listed:

$ openssl ciphers -v | column -t

Linux version of servers with ciphers above:

$uname -r
2.6.32-754.35.1.0.4.el6.x86_64

Disclaimer: I'm new at UNIX.

Comparing reports (left red are bad, right are my list), they even not listed on the right: enter image description here

Improve this question
1
  • Except for the handful of new suites for TLS1.3 (implemented only in OpenSSL 1.1.1 up, which something as obsolete as RedHat 6 probably doesn't have), the suite names in OpenSSL differ from the standard (RFC) names which most other implementations and documentation use; see the man page for [openssl-]ciphers(1) at the heading "CIPHER SUITE NAMES". But only for server application(s) that use OpenSSL; some things, even on RHEL6, do not, particular Java-based things other than Tomcat (or Wildfly) using 'native'/APR.
    – dave_thompson_085
    May 13 at 4:23

2 Answers 2

Reset to default
6

You need to configure the application that uses libssl to implement the TLS protocol. you don't need to configure openssl. For example, if you use Apache httpd webserver or nginx webserver or some mail server etc. See this reputable configuration generator: https://ssl-config.mozilla.org/

Improve this answer
1
  • How to find application(s) which use particular cipher, so I can configure them?
    – sam sergiy klok
    May 16 at 19:47
1

You can find the equivalence between the proper RFC name as reported by security and the OpenSSL name (that differs for historical reasons) in the following page: https://wildwolf.name/mapping-openssl-cipher-suite-names-to-rfc-names/

Improve this answer
1
  • This is very helpful, initally I thought that server is clean, but it was different names for the same ciphers.
    – sam sergiy klok
    May 16 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .