Eliminating the "TLS/SSL Server Supports The Use of Static Key Ciphers" vulnerability from my PAM Server (2024)

FAQs

How to disable TLS SSL server supports the use of static key ciphers? ›

In a TLS connection where (EC)DHE is not used, the key is exchanged using RSA, so the same symmetric key is used for the entire connection. In summary to disable ssl-static-key-ciphers, you will need to remove RSA from the httpd configuration.

Definitions: A key that is intended for use for a relatively long period of time and is typically intended for use in many instances of a cryptographic key-establishment scheme. Contrast with an Ephemeral key.

Step 1: Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols". Create a key named "TLS 1.1" with two DWORDs for both TLS 1.0 & 1.1: "DisabledByDefault=1" & "Enabled=0".

Disabling TLS Cipher using PowerShell cmdlet

The "Disable-TlsCipherSuite" cmdlet allows you to deactivate a specific cipher suite. By using this cmdlet, you can eliminate the cipher suite from a set of cipher suites associated with the Transport Layer Security (TLS) protocol in your computer.

​​ Disable Universal SSL certificate

Select your domain. Go to SSL/TLS > Edge Certificates. For Disable Universal SSL, select Disable Universal SSL.

Finally, there is the option for a “NULL” cipher, which simply means, the traffic should not be encrypted – so this option should definitely not be enabled. In short, you should disable known deprecated and discouraged ciphers, including DES, IDEA, 3DES, RC2, RC4, IDEA, ARIA, SEED, and NULL ciphers.

The fix was to open chrome://flags and search for the option "TLS 1.3 hybridized Kyber support" and disable it. After disabling that option, we were able to browse again.

In cryptography, a cipher is an algorithm that lays out the general principles of securing a network through TLS (the security protocol used by modern SSL certificates). A cipher suite comprises several ciphers working together, each having a different cryptographic function, such as key generation and authentication.

What's the difference between a cipher and a key? ›

The operation of a cipher usually depends on a piece of auxiliary information, called a key (or, in traditional NSA parlance, a cryptovariable). The encrypting procedure is varied depending on the key, which changes the detailed operation of the algorithm.

TLS 1.3 handshake

First the client sends a clientHello message to the server that contains a list of supported ciphers in order of the client's preference and makes a guess on what key algorithm is being used so that it can send a secret key to share if needed.

SSL is technology your applications or browsers may have used to create a secure, encrypted communication channel over any network. However, SSL is an older technology that contains some security flaws. Transport Layer Security (TLS) is the upgraded version of SSL that fixes existing SSL vulnerabilities.

Navigate to System > Configuration > Security > Inbound SSL Options. Under Allow Encryption Strength, select Custom SSL Cipher Suites. From the right pane (under Selected Cipher Suites), remove all cipher suites with RC4. Click Save Changes.