How to disable anonymous (insecure) suites ? Ref: SSLLABS

C

chuman

Member
Aug 6, 2011
14
0
51
I have Installed a SSL Certificate for Cpanel/WHM it's installed correctly when checking at ssllabs.com/ssltest I get the following error :

This server supports anonymous (insecure) suites (see below for details). Grade set to F.

Code: 
TLS_ECDH_anon_WITH_RC4_128_SHA (0xc016)   INSECURE	128
TLS_ECDH_anon_WITH_AES_128_CBC_SHA (0xc018)   INSECURE	128
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA (0xc017)   INSECURE	112
TLS_ECDH_anon_WITH_AES_256_CBC_SHA (0xc019)   INSECURE	256
TLS_ECDH_anon_WITH_RC4_128_SHA (0xc016)   INSECURE	128
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA (0xc017)   INSECURE	112
TLS_ECDH_anon_WITH_AES_128_CBC_SHA (0xc018)   INSECURE	128
TLS_ECDH_anon_WITH_AES_256_CBC_SHA (0xc019)   INSECURE	256
Kindly help me how to resolve this. Thank you in advance.
 
cPanelMichael

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,258
463
Hello :)

You can browse to the following option in Web Host Manager:

"WHM Home » Service Configuration » Apache Configuration » Global Configuration"

Use the following cipher under "SSL Cipher Suite" to disable anonymous ciphers:

Code: 
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH:!aNULL
Thank you.
 
  • Like
Reactions: postcd
cPanelMichael

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,258
463
M

MaraBlue

Well-Known Member
May 3, 2005
332
2
168
Carmichael, CA
cPanel Access Level
Root Administrator
cPanelMichael said:
Hello :)

You can browse to the following option in Web Host Manager:

"WHM Home » Service Configuration » Apache Configuration » Global Configuration"

Use the following cipher under "SSL Cipher Suite" to disable anonymous ciphers:

Code: 
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH:!aNULL
Thank you.
Click to expand...
Michael, when I change the ciphersuite to this (copied exactly as above) I get the following error:

Code: 
The following settings are invalid and were rejected:

	* sslciphersuite: ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH:!aNULL
Has something changed in the last couple of months? cPanel v 11.44.1.18.
 
cPanelMichael

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,258
463
I have not been able to reproduce that error message. Do you have any other customizations to Apache?

Thank you.
 
cPanelMichael

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,258
463
Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

Thank you.
 
G

goodmove

Well-Known Member
May 12, 2003
643
4
168
cPanelMichael said:
"WHM Home » Service Configuration » Apache Configuration » Global Configuration"

Use the following cipher under "SSL Cipher Suite" to disable anonymous ciphers:

Code: 
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH:!aNULL
Click to expand...
Can this be replicated for other services such as cpsrvd, cpdavd and dovecot?
 
vlee

vlee

Well-Known Member
Oct 13, 2005
373
26
178
Spokane, Washington
cPanel Access Level
Root Administrator
After I searched google for about about hour or so I found this below for a SSL Cipher Suite and works very good and I get a A+ on SSL LABS

Code: 
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4
All welcome to use this.
 
  • Like
Reactions: postcd and Greyscout
I

ispro

Well-Known Member
Verifed Vendor
Apr 8, 2004
628
2
168
vlee said:
After I searched google for about about hour or so I found this below for a SSL Cipher Suite and works very good and I get a A+ on SSL LABS

Code: 
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4
All welcome to use this.
Click to expand...
Thank you for sharing! Now I have A- rating and only thing missed is Forward Security:
The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-

How was you able to get A+ on cPanel server? Thank you once more!
 
vlee

vlee

Well-Known Member
Oct 13, 2005
373
26
178
Spokane, Washington
cPanel Access Level
Root Administrator
ispro said:
Thank you for sharing! Now I have A- rating and only thing missed is Forward Security:
The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-

How was you able to get A+ on cPanel server? Thank you once more!
Click to expand...
Go to in WHM Home »Service Configuration »Apache Configuration »Include Editor

Then in I wish to edit the Pre Main configuration include file for: Select All Versions

Put this below in it

Code: 
Header add Strict-Transport-Security “max-age=31536000″
SSLHonorCipherOrder On
SSLCompression off
Then click on Update button

That is it and should be able to get A+ now
 
  • Like
Reactions: postcd and Greyscout
G

garconcn

Well-Known Member
Oct 29, 2009
172
18
68
vlee said:
Go to in WHM Home »Service Configuration »Apache Configuration »Include Editor

Then in I wish to edit the Pre Main configuration include file for: Select All Versions

Put this below in it

Code: 
Header add Strict-Transport-Security “max-age=31536000″
SSLHonorCipherOrder On
SSLCompression off
Then click on Update button

That is it and should be able to get A+ now
Click to expand...
Thank you. Now I got A+ rating.
 
A

autumnwalker123

Active Member
Jan 19, 2014
44
0
6
cPanel Access Level
Root Administrator
I followed the instructions here after updating my cPanel install and removed

SSLHonorCipherOrder On
SSLProtocol +All -SSLv2 -SSLv3

from my Apache Pre Main include; however, SSL Labs is still reporting the server is vulnerable to POODLE.

Thoughts?
 
cPanelMichael

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,258
463
autumnwalker123 said:
from my Apache Pre Main include; however, SSL Labs is still reporting the server is vulnerable to POODLE.
Click to expand...
I've moved your post to this thread, so you can try some of the solutions here. Let us know if it does not help.

Thank you.
 
postcd

postcd

Well-Known Member
Oct 22, 2010
721
21
68
Hello, i have WHM 11.50

In Apache configuration i have SSL cipher:
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH (PCI recommended)

SSL/TLS Protocols:
All -SSLv2 -SSLv3 default

but when i check my site on https://sslanalyzer.comodoca.com or on https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp

it says:
Protocols enabled:
TLS1.2
TLS1.1
TLS1.0
Protocols not enabled:
SSLv3
SSLv2

https://www.ssllabs.com/ssltest/ says:
"Assessment failed: No secure protocols supported"

is it correct? Any steps to correct if its an issue? Thank you

----
Update: this topic was helpfull, i used cipher suite and apache rules adviced by member vlee. But still im getting these notices:
Protocols not enabled:
SSLv3
SSLv2
 
Last edited:
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
B How to disable annoying Imunify::Generic emails in WHM 108? Security 9
L how to disable Diffie-Hellman Security 5
S Disabled shell vs Jailed Shell with mod_ruid2 Security 2
H hell_exec() has been disabled for security reasons Security 1
Tarak Nath Possibilities to disable WordPress FileManager and phpMyAdmin plugins Security 7
Similar threads
How to disable annoying Imunify::Generic emails in WHM 108?
how to disable Diffie-Hellman
Disabled shell vs Jailed Shell with mod_ruid2
hell_exec() has been disabled for security reasons
Possibilities to disable WordPress FileManager and phpMyAdmin plugins
Top Bottom