topic Disable TLS/SSL support for static key cipher suites in Firewall and Security Management

Disable TLS/SSL support for static key cipher suites

Uncle_Wally_SA — Tue, 14 Jul 2020 12:19:51 GMT

Hi,

We recently ran a vulnerability scan and we got this recommendation "Disable TLS/SSL support for static key cipher suites" is there an SK to guide us through this? What's the impact if we implement this in terms of breaking something?

Re: Disable TLS/SSL support for static key cipher suites

_Val_ — Tue, 14 Jul 2020 14:44:45 GMT

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk126613

Re: Disable TLS/SSL support for static key cipher suites

Uncle_Wally_SA — Wed, 22 Jul 2020 08:55:01 GMT

Thanks a lot, sorry for the late response 😊

Re: Disable TLS/SSL support for static key cipher suites

nolankam — Wed, 02 Dec 2020 03:16:55 GMT

Hi, I tried this as well to disable TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA, by moving these to the "forbidden" section, ran the registry update and pushed the policy. But when we ran nmap, we had the same ciphers showing up.

Re: Disable TLS/SSL support for static key cipher suites

Uncle_Wally_SA — Wed, 02 Dec 2020 08:51:03 GMT

Did you reboot at some point? I'v noticed that sometimes it does not survive reboots