Weak cipher suite offered by configuration

weak_cipher_suite_in_config

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Family

Cryptography

Description

The suites a service will negotiate come from a configuration string: ssl_ciphers in nginx, SSLCipherSuite in Apache httpd, ssl-default-bind-ciphers in HAProxy, server.ssl.ciphers in Spring Boot, ciphers on a Tomcat connector, ssl_cipher in MySQL, tls-ciphers in Redis, CipherString in openssl.cnf.

This detector reports a suite whose own name condemns it: anonymous (ADH, AECDH, ANON), NULL cipher or NULL MAC, export-grade (EXP, EXPORT), RC4, RC2, single DES, 3DES, IDEA, or an MD5 MAC.

Suites are judged by name rather than through the algorithm catalogue because a suite is a compound — ECDHE-RSA-DES-CBC3-SHA names a key exchange, a cipher and a MAC — so it matches no single catalogue row while its components are exactly what makes it unacceptable.

Suites the setting excludes are never reported. HIGH:!aNULL:!MD5 is the hardened spelling, and reporting its aNULL and MD5 would flag the line that removes them.

Security

Every suite in the list is negotiable. The attacks are specific and not theoretical: an anonymous suite authenticates no one, so the peer can be substituted outright; a NULL-cipher suite transmits in the clear; export-grade suites use keys deliberately reduced to 40 or 56 bits and enable FREAK and Logjam; RC4 has practically exploitable keystream biases; 3DES has a 64-bit block and falls to Sweet32 within a long-lived connection; an MD5 MAC offers no integrity worth the name.

Suite order matters as much as suite membership. With ssl_prefer_server_ciphers off (or no equivalent setting) the client chooses, so a weak suite anywhere in the list is reachable by any client that prefers it — including one steered there by an attacker.

Mitigation / Fix

State a short, current list and let the server choose:

# nginx — TLS 1.3 suites are not configurable here and need no list
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;

# Spring Boot
server.ssl.ciphers=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

An explicit list of AEAD suites is better than a class expression: HIGH is defined by the linked OpenSSL version, so what it admits changes under you on upgrade, whereas an enumerated list is reviewable and stable. If you keep a class expression, keep the exclusions with it (HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!RC4:!MD5).

Verify the result against the deployed service rather than the file — openssl s_client -cipher or testssl.sh — since a reverse proxy or load balancer in front may terminate TLS with its own list.