Disable TLS/SSL support for static key cipher suites

[Walter_Mutebuka]

Hi,

We recently ran a vulnerability scan and we got this recommendation "Disable TLS/SSL support for static key cipher suites" is there an SK to guide us through this? What's the impact if we implement this in terms of breaking something? 

[_Val_ · Accepted solution]

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Walter_Mutebuka]

Thanks a lot, sorry for the late response 😊

[nolankam]

Hi,  I tried this as well to disable TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA, by moving these to the "forbidden" section, ran the registry update and pushed the policy. But when we ran nmap, we had the same ciphers showing up. 

[Walter_Mutebuka]

Did you reboot at some point? I'v noticed that sometimes it does not survive reboots