Detections
Analytics

SSL/TLS Recommended Cipher Suites

info Nessus Plugin ID 156899

Language:

Synopsis

The remote host advertises discouraged SSL/TLS ciphers.

Description

The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites:

TLSv1.3:
 - 0x13,0x01 TLS13_AES_128_GCM_SHA256
 - 0x13,0x02 TLS13_AES_256_GCM_SHA384
 - 0x13,0x03 TLS13_CHACHA20_POLY1305_SHA256

TLSv1.2:
 - 0xC0,0x2B ECDHE-ECDSA-AES128-GCM-SHA256
 - 0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
 - 0xC0,0x2C ECDHE-ECDSA-AES256-GCM-SHA384
 - 0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
 - 0xCC,0xA9 ECDHE-ECDSA-CHACHA20-POLY1305
 - 0xCC,0xA8 ECDHE-RSA-CHACHA20-POLY1305

This is the recommended configuration for the vast majority of services, as it is highly secure and compatible with nearly every client released in the last five (or more) years.

Solution

Only enable support for recommened cipher suites.

See Also

https://wiki.mozilla.org/Security/Server_Side_TLS

https://ssl-config.mozilla.org/

Plugin Details

Severity: Info

ID: 156899

File Name: ssl_recommended_ciphers.nasl

Version: 1.4

Type: remote

Family: General

Published: 1/20/2022

Updated: 2/12/2024

Supported Sensors: Nessus

Vulnerability Information

Excluded KB Items: global_settings/disable_test_ssl_based_services