Reputation: 11
Currently my ssl_ciphers string looks like this:
ssl_ciphers='ALL:!ADH:!LOW:!EXP:!MD5:!aNULL:!eNULL:!NULL:!3DES:!RC4:!SSLV2:@STRENGTH'
I want to exclude TLSv1.0 and TLSv1.1 ciphers along with following ones:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_SEED_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_SEED_CBC_SHA
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
TLS_RSA_WITH_IDEA_CBC_SHA
I was able to exclude TLSv1.0 and TLSv1.1 ciphers using below
ssl_ciphers='ALL:!ADH:!LOW:!EXP:!MD5:!aNULL:!eNULL:!NULL:!3DES:!RC4:!SSLV2:!TLSv1.0:!TLSv1.1:@STRENGTH'
Edit: Above change(adding !TLSv1.0:!TLSv1.1) did not exclude TLSv1.0 and TLSv1.1 ciphers as I can still see them in nmap results.
Is there any way to exclude TLSv1.0 and TLSv1.1 from ssl_ciphers?
Upvotes: 0
Views: 413