Technical Tip: How to verify if static Cipher suites are disabled

A security audit would need static ciphers to be disabled on the FortiGate for compliance purposes. Encryption level can be controlled as defined in the document: FortiGate encryption algorithm cipher suites

A few of the most common static ciphers are listed below.

Static RSA:

TLS_RSA_WITH_NULL_MD5
TLS_RSA_WITH_NULL_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_IDEA_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384

Static DH:

TLS_DH_DSS_WITH_DES_CBC_SHA
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
TLS_DH_RSA_WITH_DES_CBC_SHA
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA

Static ECDH:

TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

To confirm if the Ciphers are disabled, NMAP ( nmap -p 443 --script ssl-enum-ciphers xx.xx.xx.xx ) can be initiated. Screenshots below show the cipher results when 'ssl-static-key-ciphers' are enabled and disabled (Illustration with RSA). 

config system global

    set ssl-static-key-ciphers enable

end

config system global

    set ssl-static-key-ciphers disable

end

Vulnerability Assessment would still show static Ciphers in the report even though it is disabled under the global config. Virtual-Server and SSL VPN config would also have to be modified to disable static Ciphers.

config vpn ssl settings
    set ssl-min-proto-ver tls1-2
    set banned-cipher SHA1 SHA256 SHA384
end

Results with the banned cipher RSA:

config vpn ssl settings
    set ssl-min-proto-ver tls1-2
    set banned-cipher RSA
end

Static Ciphers under VIP/Virtual servers can be controlled with the following config:

config firewall vip
    edit "VIP"
        set ssl-dh-bits 2048
        set ssl-algorithm high
        set ssl-pfs require
        set ssl-min-version tls-1.2
        set ssl-max-version tls-1.3
    next
end

SSL-Algo can be set to custom, and specific ciphers can be selected.

Related articles:

Disable weak ciphers in the HTTPS protocol

FortiGate encryption algorithm cipher suites