Option 1) System administrators should consider replacing the current SSL certificate used for the LDAPS connection to ensure that a certificate compatible with the four cipher suites enabled by default is used.
Option 2) System administrators can use the cell management tool to explicitly enable other weaker supported cipher suites that are disabled by default if they wish. This can performed in a rolling fashion across the VCD Cells to avoid downtime.
The below example enables the configuration to match the default settings found in Cloud Director 10.2.1.
- SSH to the first Cloud Director Cell and use the Cell Management Tool to see the current configuration.
/opt/vmware/vcloud-director/bin/cell-management-tool ciphers -l
- Change the configuration to match the default settings found in Cloud Director 10.2.1 using these two command.
/opt/vmware/vcloud-director/bin/cell-management-tool ciphers -d
/opt/vmware/vcloud-director/bin/cell-management-tool ciphers -d TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA
- Check the allowed cipher list is updated.
/opt/vmware/vcloud-director/bin/cell-management-tool ciphers -l
- Restart the cell.
- Repeat steps 1 - 4 for each VCD Cell in the environment.
WARNING - The process above will enable the below ciphers which are weak and have known vulnerabilities to CBC (Cipher Block Chaining) and cipher suites that use non-randomized padding:
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_RSA_WITH_AES_256_GCM_SHA384