1

We have SSLv3 disabled in DataPower. I ran sslscan to check what all cipher suites can be used currently during SSL handshake.

In the sslscan output, I have found out that below cipher suites are being accepted.

TLSv1  256 bits  AES256-SHA
TLSv1  128 bits  AES128-SHA
TLSv1  168 bits  DES-CBC3-SHA
TLSv1  128 bits  RC4-SHA

Preferred Server Cipher: TLSv1  256 bits  AES256-SHA

I then, disabled TLS1.0 on DataPower (server) and ran the sslscan again. The result was not what I was expecting. All the ciphersuites including the ones which were accepted during handshake over TLS1.0 are being rejected.

How would I come to know, which cipher suits my server will accept if I disable TLS1.0?

2
  • 2
    This is really a question for serverfault (where you should specify what software you're using). If you want to know what cypher suites you can use with OpenSSL (one of the implementation of TLS), you can go there: openssl.org/docs/manmaster/apps/ciphers.html
    – Stephane
    Dec 15, 2015 at 14:00
  • You also might want to check the appropriate RFC.
    – Iszi
    Dec 15, 2015 at 14:26

1 Answer 1

1

Your output only references TLS 1.0, and disabling it refuses those disabled TLS 1.0 choices as it should. Refer to the DataPower references and documentation to support TLS 1.1 and TLS 1.2 as well as configuring cipher suites. Start with checking your firmware version and properly upgrading to better support the latest TLS configurations.

Here is a reference for DataPower supporting TSL 1.1 and TLS 1.2 by default in firmware version 6. Your current version may not support anything but TLS 1.0, and not allowing yet to configure TLS 1.1, nor TLS 1.2. http://www-01.ibm.com/support/docview.wss?uid=swg21578730 references specific crypto configurations to get granular enough to resolve issues within each TLS version, such as beast.

Once upgraded and configured re-run sslscan, or alternatives if you would like to compare against sslscan such as testssl.sh.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .