Koozali.org: home of the SME Server

Ciper issue reported by zencart team

Offline jameswilson

  • *
  • 777
  • +0/-0
    • Security Warehouse, trade security equipment
Ciper issue reported by zencart team
« on: May 26, 2024, 01:22:03 AM »
Ive been sent the following
Quote
[insecure_cipher_suites] => Array
        (
            [TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA] => Array
                (
                   
  • => uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order

                )

            [TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA] => Array
                (
                   
  • => uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order

                )
        )

Can/should I disable 3DES?
I can see there is a way to modify the ciphers with a templete here
https://wiki.koozali.org/SSL_Settings

but dont want to just blindly do this?

James
« Last Edit: May 26, 2024, 02:31:48 AM by jameswilson »

Offline Jean-Philippe Pialasse

  • *
  • 2,814
  • +11/-0
  • aka Unnilennium
    • http://smeserver.pialasse.com
Re: Ciper issue reported by zencart team
« Reply #1 on: May 26, 2024, 03:18:09 AM »
default is disabled so you might have enabled it yourself.

Offline jameswilson

  • *
  • 777
  • +0/-0
    • Security Warehouse, trade security equipment
Re: Ciper issue reported by zencart team
« Reply #2 on: May 26, 2024, 01:02:55 PM »
Hi JP
I dont think I have 'enabled' them but I also note this page

https://www.ssllabs.com/ssltest/analyze.html?d=www.securitywarehouse.co.uk

that reports this

Offline jameswilson

  • *
  • 777
  • +0/-0
    • Security Warehouse, trade security equipment
Re: Ciper issue reported by zencart team
« Reply #3 on: May 26, 2024, 01:03:12 PM »
Im far from sure but is that related.

Offline mmccarn

  • *
  • 2,638
  • +10/-0
Re: Ciper issue reported by zencart team
« Reply #4 on: May 26, 2024, 03:10:38 PM »
Scan your host with https://www.ssllabs.com/ssltest and make adjustments until your Overall Rating is "A"

Offline Jean-Philippe Pialasse

  • *
  • 2,814
  • +11/-0
  • aka Unnilennium
    • http://smeserver.pialasse.com
Re: Ciper issue reported by zencart team
« Reply #5 on: May 26, 2024, 03:15:21 PM »
it is already A. 
the weak cipher are usual with this score and wanted unless you want to reject a lot of legitimate clients. 


from where do you get the first message?