Questions tagged [cipher]
The cipher tag has no usage guidance.
57
questions
0
votes
1answer
36 views
Ubuntu Key Exchange Algo
I am trying to test the connectivity to several network devices, with Ansible installed on Ubuntu 20.04.2 LTS, using ansible ad-hoc.
The problem:
SSH is not working as the device's key exchange method ...
0
votes
0answers
26 views
Find missing TLS Cipher
I'm running gitea behind a traefik proxy. Everything works fine except git push/pull to this git server. The http webfrontend is also working without problems.
As soon as i want to clone a repository, ...
-1
votes
1answer
106 views
Should I configure Ciphersuites on openssl after setting MinProtocol and CipherString?
Current OpenSSL version
OpenSSL 1.1.1d 10 Sep 2019 (Library: OpenSSL 1.1.1g 21 Apr 2020)
Current openssl.cnf configuration
At the top of the file
openssl_conf = default_conf
At the bottom of the ...
0
votes
0answers
31 views
Disable SSL Medium Strength Cipher Suites (SWEET32) in Java
I have a CVE (CVE-2016-2183) that I need to resolve. This is for disabling SSL Medium Strength Cipher Suites (SWEET32). I've disabled this explicitly on all my servers by disabling the cipher in ...
0
votes
0answers
29 views
Are there any Operating Systems or Browsers that still depend on having these Ciphers enabled?
Doing a litle Cryptography Research and hit a case of conflicting data so wanted to try here.
I'm running a Web Service and currently support these 2 Ciphers:
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0X9F)...
0
votes
0answers
29 views
Apache SSLCipherSuite directive in letsencrypt ignored
I have a web application using Apache 2.4 that runs an external API. Recently a client had trouble connecting to our system due to an SSL handshake failure. They went on ssllabs and found that our ...
0
votes
2answers
179 views
TLS 1.2 with RSA vs ECDSA Ciphers
Microsoft has reported that it will only support TLS 1.2 with at least one of the following ciphers:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
...
0
votes
1answer
880 views
How to disable TLS_AES_128_GCM_SHA256 (or, how to set TLSv1.3 ciphers) in postfix
I have the following in my TLS configuration, but the only problem I have is that TLS_AES_128_GCM_SHA256 is a 128 bit cipher, and I would like to remove it:
smtpd_tls_eecdh_grade = ultra
...
0
votes
0answers
32 views
How can I use this same Cipher suite on Dovecot?
I have the following cipher suite on Apache:
#TLSv1.3
SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
#TLSv1.2
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-...
2
votes
1answer
243 views
How to disable AES128 in Apache?
I am using the following cipher, which I keep updating today, don't worry if there is any incompletion in it. Just help me disable AES128.
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:!AES128
It is ...
0
votes
0answers
33 views
Kerberos Authentication requested cipher removal
Kerberos Authentication help required. Please find below:
I am doing domain join from my Client machine(Freebsd 10.1) to KDC(Win2012)
Client machine:
uname -a
FreeBSD 10.1-RELEASE FreeBSD 10.1-...
0
votes
0answers
168 views
SSL Cipher Suites in nginx do not match SSL Labs
I am trying to install this plugin on Wordpress which fails to communicate with my server, and the plugin developer says it's because my cipher suites don't match their requirement. https://www....
0
votes
0answers
106 views
Cipher names (ipsec)
I've got this in my syslog
470 Nov 22 11:32:23 mini31 ipsec[8820]: 13[IKE] 192.168.1.7 is initiating a Main Mode IKE_SA
471 Nov 22 11:32:23 mini31 ipsec[8820]: 13[CFG] received proposals: IKE:...
0
votes
0answers
30 views
SSL handshake failure when EC type keystore is exchanged
I have a Spring boot (version 2.2.5.RELEASE) application which works on one-way SSL.
There are 2 cases:
Case 1: Client has all the RSA type ciphers (TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,...
1
vote
1answer
567 views
Windows Server 2012 R2 - Adding Cipher
this might be a complete newbee question.
I have an 2012 R2 Server on which an application should call a partner who only offers the following ciphers:
(0xc02f) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ...
0
votes
1answer
2k views
How do I disable just one cipher out of OpenSSL TLSv1.3 list?
I use Nginx + Let's Encrypt with OpenSSL on my server. I wanted to use TLSv1.2 and TLSv1.3. But I wanted to use very specific SSL ciphers. Specifically:
TLS_AES_256_GCM_SHA384 (TLSv1.3),
...
0
votes
1answer
83 views
Need help for TLS1.2 Cipher disabling in RHEL satellite server version - 6.5.2
We need to disable TLS_RSA_WITH_AES_256_GCM_SHA384 running on port 8008 and 9090 .
Below processes are running on ports 8008 and 9090 respectively -
ruby /usr/bin/smart_proxy_dynflow_core -d -p /var/...
1
vote
2answers
2k views
Missing cipher suites on Windows Server 2019
I am using a MEMCM Task Sequence to build servers running Windows Server 2019. So far, I build 22 servers with this OS. At the end of OSD, on 20 of them I have only 10 cipher suites available for use.
...
1
vote
1answer
296 views
How to avoid use of medium strength ciphers in WAS liberty server with openJDK 1.8
Good day,
I have a IBM WAS liberty server, which is place under OS redhat linux, with openjdk version 1.8.0_242.
I receive a pentest report that complain about this server is using medium strength ...
2
votes
1answer
8k views
How can I disable TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 cipher in Apache2?
In SSL labs, I got that I'm using this "weak cipher":
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Now in Apache, this is the set of suites I have enabled:
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:...
1
vote
1answer
355 views
Missing openssl cipher-algorithms on specific VMs/Hoster
I'm trying to use AES-128-CBC-HMAC-SHA256 but this cipher-algorithm isn't available on a VM on a specific hosting provider.
The OS, installed packages, Kernel, openssl version, and the like are the ...
1
vote
1answer
73 views
SSLCipherSuite - more precise definition, need only strong ciphers
The Apache documentation of SSLCipherSuite seems a little vague and the examples I found on the web make it much worse. I see a lot of references to "all", long lists of specific ciphers and lots of "...
0
votes
1answer
68 views
ADFS stop working
So I tried to secure our domain controllers with a narrowed list of Ciphers and now the Office 365 ADFS is broken for Chrome and Firefox. I need some help trying to figure out how to put it back. I ...
0
votes
1answer
2k views
Disabling the AES cipher suites without ECDHE key exchange algorithm
Currently, we are having below cipher suites used in our platform.
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
Post ...
1
vote
1answer
5k views
Disable weak Cipher ubuntu 16
I have started security scanning my network and have issues with Ubuntu 16 and weak cipher suites. I think I found the sshd config. but everything I read on the TLS for apache tells me to go to /etc/...
0
votes
1answer
1k views
connecting to a FTP by TLS fails from one client, but succeeds from the other
Trying to connect from client2 using the following string works:
client2@client2 curl -v --ssl -u 'user:password' ftp://www.example.com:21
* Rebuilt URL to: ftp://www.example.com:21/
* Trying 192....
0
votes
0answers
1k views
Log Client Ciphersuite in HAProxy
We know of log configurations that can log negotiated cipher-suite info in successful connections.
But what we need to do is to log the client cipher-suite info that HAProxy gets hold of during TLS ...
1
vote
1answer
4k views
Postfix 2.6.6 with TLS - unable to receive emails from GMail (and a couple of other MTAs) but others are OK, why?
I've just had to look at a CentOS 6 server running Postfix 2.6.6 which was able to send emails to everyone, but could not receive them from GMail (and a few other MTAs) due to incoming TLS negotiation ...
1
vote
1answer
949 views
Websphere MQ 7.0.1-14 - able to add missing ssl cipher suites?
I have to connect to a MQ 9 QMGR, which does not allow the available Cipher Suites I can choose from in MQ Explorer that is part of my 7.0.1-14 installation (Linux x86_64).
Can I add the needed ...
0
votes
2answers
1k views
Reclaim deleted space on SAN from thin provisioned LUN with zeros on Windows
Dear Data Storage Experts,
We are using a SAN attached thin-provisioned LUN on Physical Windows machine from a storage vendor. Storage chargeback is based on high watermark (deleted space not ...
3
votes
2answers
15k views
Disabling weak protocols and ciphers in Centos with Apache
Can anyone help me determine hat could be the reason I am still getting VA gaps from scanner for the following? My server hosts multiple web app, but I am using the same settings for all virtual hosts....
0
votes
2answers
126 views
Apapche web server redirect unsupported ciphers to http?
We will be turning off support for browsers that only support TLS1.0
When we turn off support for TLS 1.0 on our web server can we redirect browsers that don't support TLS 1.1 or higher to a http ...
0
votes
1answer
2k views
How to handle cipher suite mismatch between two servers
I have an IIS website running on two servers. One server is Windows Server 2016, the other Windows Server 2012. Under certain circumstances these two servers need to talk to each other.
The ...
1
vote
0answers
506 views
Troubleshooting Cipher handshake issue
All right, so I have work with our networking engineers and it just appears that nobody is able to figure this issue out and so I'm all out of options as I have attempted to Google research this issue ...
3
votes
0answers
332 views
Apache TrafficServer as reverse proxy gives empty cipher list
I am trying to setup Apache Trafficserver as a reverse proxy.
(Debian Stretch, ATS 7.0.0 (also tried 7.1.2 from backports), openssl 1.1.0f)
Everything went fine so far, until I came accross ...
1
vote
2answers
5k views
Postfix not using TLS ciphers it is supposed to use
I can't receive emails from certain hosts because of a no shared cipher error:
postfix/smtpd[15934]: warning: TLS library problem: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:...
2
votes
1answer
2k views
How to disable TLS v1.1 in Nginx [closed]
It seems to be a straightforward configuration setting, but I cannot disable TLSv1.1.
nginx.conf in /etc/nginx:
ssl_protocols TLSv1.2;
Domain configuration last_nginx.conf (changed via Plesk ...
0
votes
1answer
2k views
Forward secrecy support?
Is it possible to amend the SSL ciphers to support forward secrecy on my CentOS server running Apache 2.4? I currently have the following cipher setup:
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-...
0
votes
1answer
1k views
Disable SHA1 now Firefox won't work
I've been tasked to get our site into PCI compliance by disabling SHA1 on the server. I am accomplishing this by using IIS Crypto 2.0. We decided to also go with just TLS 1.2. the specific problem I ...
0
votes
1answer
436 views
Best practice: Wowza SSL Configuration
Screenshot: Server with Wowza running using a SSL certificate with basis configuration
I get this result from the SSLLabs with the default configuration (see screenshot). The only places I can change ...
0
votes
1answer
321 views
JBoss SSLHonorCipherOrder Unexpected Attribute
We have recently moved to HTTPS and we are using Jboss 7.1.0 AS. We have the following standalone.xml configuration at our end.
<subsystem xmlns="urn:jboss:domain:web:1.1" native="false" default-...
1
vote
1answer
183 views
RHEL ports not using same cipher
[UPDATE]
I ran the openssl command from a couple servers and my local machine. It seems like port 9443 is not remaining consistent. The cipher on server1:9443 remained the same from the first server (...
0
votes
2answers
3k views
Windows, IIS, Remote Desktop: after disabling insecure ciphers for ssl, I cannot login with remote desktop [closed]
In the process of setting up an HTTPS website and in the best practices of it, firstly I disabled ssl v3 (no problem with that) and then I disabled older insecure ciphers and only enabled:
...
0
votes
1answer
972 views
Server has “weak cipher setting” according to security audit, replaced offending cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA, but still failing retest audit?
We received an audit from our local cyber security team in which one of our servers displays "Insufficient Transport Layer Protection".
According to their description:
"
DESCRIPTION:
The server ...
0
votes
1answer
197 views
Ciphersuite Priority And Handshake
I ran a program called cipherscan, against 2 servers that communicate with each other via TLS.
Cipherscan prints details about each server's TLS capabilities. Given the data, I'm wondering how to ...
0
votes
1answer
122 views
SSL S2S communication, protocol and ciphers
about a server/server S2S communication:
1st server has on Apache .conf:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-...
0
votes
1answer
421 views
Can I configure IIS to listen to many, yet different cipher configurations of TLS?
I need to programmatically determine the TLS features of a client and underlying host based on Javascript.
What webserver instance (apache, IIS, etc), allows for different configurations of SSL ...
3
votes
1answer
820 views
What dictates the available Cipher Suites in GlassFish and Payara?
I have the same version of Payara Server (4.1.1.154) running on two different machines. I do not have the same list of available cipher suites between the two. What determines the available cipher ...
-1
votes
1answer
140 views
How to support more HTTPS Ciphers?
I am debugging an IoT device that I am making. I am having it try and connect to my website (EC2 hosted) over HTTPS. The device is running into an issue negotiating the TLS handshake, and it is ...
0
votes
3answers
44 views
How to list all HTTP Cyphers a client supports
I have a HTTPS client (a GSM modem) where I need to know the supported ciphers to configure my nginx. But the requests just fail and are not even listed in my nginx log.
Is there a simple way to ...
