Technical Tip: How to control static-key ciphers for explicit DoT and DoH traffic

On FortiOS 7.0, 'ssl-ssh-profile' added 'min-allowed-ssl-version' per protocol, and it's applied to DoT and DoH.

This option limits the minimum allowed SSL version but 'ssl-ssh-profile' does not have control to filter static key ciphers.

Hence the following global commands were introduced to control explicit DoT handshake in 7.0.6 and 7.2.0 onward.

config system global
    set ssl-min-proto-version           <SSLv3|TLSv1|TLSv1-1|*TLSv1-2|TLSv1-3>
    set ssl-static-key-ciphers <*enable|disable>
    set strong-crypto <*enable|disable>
end

DoT can use a pre-filtered cipher list now.

Disabling the 'ssl-static-key-ciphers' setting on a FortiGate device will prevent the use of static key ciphers like AES128-SHA1, AES256-SHA1, AES128-SHA256, and AES256-SHA256 in TLS sessions. This enhances security by ensuring that only ephemeral key exchange methods (like (EC)DHE) are used, which provide forward secrecy.