How do I disable weak ciphers?

Short answer

In the Cipher Algorithms field of a TLS Security Profile, a strong preset set (General, Strict Secure or Strict Hardware Accelerated) is selected, or Manual is selected and the suites are specified one by one in the Algorithm List field, with weak families such as RC4, 3DES and SHA1 excluded with !; the list can also be taken from a text file with Import Ciphers. The profile is selected in the vService's Details panel, in the SSL Security module; for TR7's Backend Service connection, the same profile is used in the Backend SSL Security Profile field. This setting determines the suites of TLS 1.2 and earlier versions; the TLS 1.3 suites are already strong.

Problem: Scans Find Weak Cipher Suites

Suites based on RC4, 3DES and SHA1 that are left enabled for compatibility with old clients, and suites with static RSA key exchange that do not provide forward secrecy, come up as findings in security scans and lower the SSL Labs grade. The Only Secure Ones set in the default profile (HIGH:!aNULL:!MD5) also includes CBC suites without forward secrecy and with SHA1. The presented suites need to be limited to the strong ones.

Solution: Four Methods

Methods 1 and 2 fill in the same profile field in different ways; Method 3 makes the same setting from the command line; Method 4 is for TR7's server connection.

Your situation	Suitable method
A preset strong set is enough	Method 1: Preset Set
Specifying the suite list one by one or taking it from a file	Method 2: Manual List and Import Ciphers
From the command line	Method 3: WEB-CLI
The TLS connection that TR7 sets up to the Backend Services	Method 4: Backend SSL Security Profile

Preset sets:

Set	Content	Recommendation
General	Eight GCM and CHACHA20 suites with forward secrecy (ECDHE/DHE)	Internet-facing services
Strict Secure	Only forward secrecy + AEAD; static RSA, SHA1, 3DES/RC4, CAMELLIA/ARIA excluded	The strictest compatible set
Strict Legacy Compatible	Strict Secure + AES-CBC with ECDHE/DHE (SHA256 and above) for old clients	If there are old clients
Strict Hardware Accelerated	Only forward secrecy + AES-GCM	Environments with AES hardware acceleration
Only Secure Ones	HIGH:!aNULL:!MD5 (Default Profile)	Also includes suites without forward secrecy and with SHA1
Old Client Supported, Hardware Supported	Weak suites such as CBC-SHA, DES-CBC3-SHA, RC4 included	Avoided
TLS v1.3 Compatible	Only TLS 1.3 suite names	Contains no TLS 1.2 suite; to force TLS 1.3, Min. SSL Version = TLSv1.3 is used instead of the set

Method 1: Preset Set Recommended

• How it works The selected preset set determines the suites accepted on the encrypted frontend rows of the vServices that use the profile.
• Where it is openedCertificates & PKI → TLS Security Profiles → Add / Edit → Cipher Algorithms
• Requirement An encrypted frontend (Encrypted (HTTPS) or TCP + TLS) on the vService
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → TLS Security Profiles screen, Add is clicked (how to add); if there is a custom profile used on the vService, that profile is selected and Edit is clicked.

2

Adım 2 Enter the name

The Security Profile Name is entered. If Min. SSL Version is set to TLSv1.2 in the same form, the old versions are also disabled (How do I disable TLS 1.0/1.1; is TLS 1.3 supported?).

3

Adım 3 Select the set

In the Cipher Algorithms field (default Only Secure Ones), General, Strict Secure or Strict Hardware Accelerated is selected. When a preset set is selected, the Manual list stored in the profile is deleted.

4

Adım 4 Save the profile

The Add button at the bottom of the form is clicked (Edit on an existing profile); the edited profile is reapplied to all the vServices that use it.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

6

Adım 6 Select the profile

In the Details panel, the SSL Security box under Frontend Settings is checked and the profile is selected (profile selection on the vService).

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Presented suitesTR7 side

sslscan is run in the TR7 WEB-CLI; on the client side, nmap --script ssl-enum-ciphers -p 443 203.0.113.10 also gives the same list.

Command: sys-cmd sslscan --sni-name=www.example.com 203.0.113.10:443

ExpectedOnly ECDHE/DHE + GCM/CHACHA20 suites; no RC4, 3DES, SHA1

Method 2: Manual List and Import Ciphers

• How it works The suites to be accepted and the families to be excluded are selected one by one; items starting with ! exclude that family. The selection order is the preference order of the server. The list can also be taken from a text file with one suite name on each line.
• Where it is opened Profile form → Cipher Algorithms = Manual → Algorithm List · Import Ciphers
• Requirement None for manual selection; for import, a text file of at most 16 KB
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

On the Certificates & PKI → TLS Security Profiles screen, Add is clicked, or an existing profile is selected and Edit is clicked; in a new profile, the Security Profile Name is entered.

2

Adım 2 Create the list

To create it manually, Cipher Algorithms = Manual is selected; in the Algorithm List field that appears, the desired suites (e.g. ECDHE+AESGCM, ECDHE+CHACHA20) are selected in order, and weak families are excluded with items such as !RC4, !3DES, !SHA1, !kRSA, !aNULL, !MD5. To take it from a file, Import Ciphers above the field is clicked and the file is selected; the field switches to Manual automatically, and unrecognized names are listed with the CIPHERS NOT ADDED warning. If the list is left empty, the default list of the engine applies.

3

Adım 3 Save the profile

The Add (or Edit) button at the bottom of the form is clicked.

4

Adım 4 Assign the profile to the vService

The profile is selected on the vService with steps 5–7 of Method 1, and the vService is saved.

Verification

1List and presented suitesTR7 side

When the pointer is held over the Export Ciphers (N) button in the profile form, the effective list appears; then the sslscan check in Method 1 is performed.

ExpectedThe excluded families are not in the sslscan output

Method 3: WEB-CLI

• How it works The cipher set of the profile is changed from the command line. In a profile newly created with WEB-CLI, if --cipherAlgorithm is not written, the weak Hardware Supported set is saved; the set is always written explicitly.
• Where it is opened TR7 WEB-CLI → lb ssl-security update · lb ssl-security add
• Requirement WEB-CLI access
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Change the preset set

The set of the existing profile is replaced with a preset set (version and cipher fields); instead of <profile>, the profile name is selected with Tab:

lb ssl-security update id <profile> --cipherAlgorithm strictSecure

2

Adım 2 Create a profile with a Manual list (if needed)

If a manual list is needed, a new profile is created; the list order is the preference order:

lb ssl-security add name strict-manual --minSslVersion TLSv1.2 --cipherAlgorithm manual --manualCipherAlgorithmList.0 ECDHE+AESGCM --manualCipherAlgorithmList.1 ECDHE+CHACHA20 --manualCipherAlgorithmList.2 !SHA1 --manualCipherAlgorithmList.3 !kRSA

The profile is assigned to the vService with lb service update id <vService> --sslSecurity strict-manual.

Verification

1Presented suitesTR7 side

The sslscan check in Method 1 is performed.

Command: sys-cmd sslscan --sni-name=www.example.com 203.0.113.10:443

ExpectedNo weak suites

Method 4: Backend SSL Security Profile

• How it works The suites to be used in the TLS connection that TR7 sets up to the Backend Service are limited with a profile; while a profile is selected, the Ciphers (Standard / Low) field on the Backend Service is not applied.
• Where it is openedLoad Balancer → Backend Services → Edit → SSL Service → Backend SSL Security Profile
• RequirementSSL Service on in the Backend Service
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Prepare the profile (if needed)

If there is no profile with a strong set, it is created with steps 1–4 of Method 1.

2

Adım 2 Open the Backend Service edit form

On the Load Balancer → Backend Services screen, the Backend Service is selected and Edit is clicked; SSL Service must be on.

3

Adım 3 Select the profile

The profile is selected in the Backend SSL Security Profile field (default None).

4

Adım 4 Save

The Edit button at the bottom of the form is clicked; the server connection of all the vServices that use the Backend Service is set up with these suites.

Verification

1Server connectionTR7 side

The health status of the Backend Service is checked in the Load Balancer → Backend Services list; if the server supports none of these suites, the connection cannot be set up.

ExpectedBackend Service healthy, traffic flowing

Common Mistakes

• Thinking the Only Secure Ones set is the most secure set. This set also includes CBC suites without forward secrecy and with SHA1; for a strong configuration, General or one of the Strict sets is selected.
• Selecting the TLS v1.3 Compatible set to force TLS 1.3. This set contains no TLS 1.2 suite; the version restriction is made with Min. SSL Version = TLSv1.3.
• Expecting the list to change the TLS 1.3 suites. The cipher list determines the suites of TLS 1.2 and earlier versions; TLS 1.3 connections use the TLS 1.3 suites of the engine.
• Creating a profile in WEB-CLI without specifying a set. In a profile created with WEB-CLI, the default set is Hardware Supported; --cipherAlgorithm is written explicitly.
• Creating the profile and not selecting it on the vService. The profile is not applied unless the SSL Security box is checked and the profile is selected on the vService.

How it is done in the documentation

• TLS Security Profiles · Cipher Algorithms
• TLS Security Profiles · Algorithm List
• TLS Security Profiles · Import Ciphers / Export Ciphers
• Backend Services · Backend SSL Security Profile

Related questions

• Can I import/export cipher lists?
• How do I disable TLS 1.0/1.1; is TLS 1.3 supported?
• What should I do to get an A+ from SSL Labs?