TLS Cipher Suite Hardening ACME Interface
Hi there,
We enhance our SSL/TLS configuration with the config below but this does not affect the ACME interface.
How can we (due to an audit) harden the ACME interface?
config system global
set admin-https-ssl-banned-cipher RSA DHE SHA1 SHA256 SHA384 ARIA
end
The ACME interface still supports the following chipers:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1)