Enforcing TLS level with Inbound HTTPS Inspection

[Ruan_Kotze]

Good Day,

I have an interesting scenario and my research is giving me conflicting answers.

I am publishing a webserver through an R81.10 T190 gateway (Managed by an R82 SMS).  Inbound HTTPS inspection has been configured and is working well.  There is one interesting aspect to my the https inspection rulebase.  The webserver has a single IP but hosts multiple websites sitting on different domains (thus I cannot make use of wildcard certificates).  In order to get inspection working I've had to add a custom application definition to the the inspection policy, like so:

This works well and allows me to inspect all sites.The backend webserver is hardened and configured to reject all TLS versions below 1.2.

My challenge is as soon as I enable inspection security scanners flag the sites as accepting connections TLS 1.0 and higher.

Here is where things get curious - running cipher_util and selecting SSL Inspection is only showing me TLS 1.2 and TLS 1.3 ciphers.  In the old days we could set the ssl_min_ver  using GuiDBedit, but I believe that has been deprecated. For what it's worth the setting there is TLS1.0 and TLS1.2 for ssl_min_ver and ssl_max_ver respectively.

Why would my gateway be offering these deprecated ciphers (considering it's disabled on the back-end site), and how to correct it?

Thanks,
Ruan

[Ruan_Kotze]

Quick Update,

3 new datapoints:
The gateways still obeys the ssl_min_ver parameter. I raised the min_ver to 1.1 and this reflected in my scan result.
Conversely, ssl_max_ver is not obeyed. Despite it set to 1.2 (no option exists for 1.3) scans correctly show the website as offering 1.3
Setting the access policy Service to TLS1.2 (as opposed to HTTPS) surprisingly has no impact on scan result.

Thanks,
Ruan

[Lesley]

please share correct version number and take number T183 is latest version for R81.10 that is now EOL

[Ruan_Kotze]

Good Catch, indeed it is T183.

Gateways are slated for upgrade to R82 in the next month - I will definitely make a note to see if the findings are still valid.

[Lesley]

I would upgrade first and then see what ssllabs will report regarding ssl ciphers after that follow indeed the cipher tool. Note there are many changes done in R82 for https inspection: 

[Ruan_Kotze]

Hi All,

Doing a bit of thread resurrection here. No behaviour changes in R82 T107 despite the HTTPS inspection improvements.

My conclusion is that cipher_util and the like only applies to outbound inspection. Inbound inspection TLS version is governed through Guidbedit only.  The only official documentation I could find confirming this was in the Mobile Access Administration Guide:

There are some concerns for me with how inbound inspection is handled:

1. The gateway by default will listen on TLS1.0, TLS1.1 and TLS1.2.  The first two are long deprecated and raises both operational security and audit / governance concerns.
2. Seemingly no support for TLS 1.3 (not listed as an option in Guidbedit)
3. Documentation seems incorrect in that on two seperate clusters I tested this on, ssl_min_ver default is TLS1.0

Thanks,
Ruan