Nessus: SSL Medium Strength Cipher Suites Supported & SSL Weak Cipher Suites Supported

[wagnbeu0]

Hi, I´m running a JBOSS 4.2.3 GA version on W2K3 Server x64.

Now my sec department send me this mails:

SSL Medium Strenght Ciper Suites Supported

SSL Weak Cipher Suites Supported

My server.xml has this entries:

SSLCipherSuite="HIGH:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW:!aNULL:!MD5"

But it does not work. What do I need to do to prevent theese error messages?

[wagnbeu0]

Okay, I got the solution. You need to add this line:

SSLCipherSuite="HIGH:!ADH:!SSLv2:!EXPORT40:!EXP:!LOW:!aNULL:!MD5"
ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"

Now the errormessage is away.