Disabling weak ciphers in vCenter Update Manager
search cancel

Disabling weak ciphers in vCenter Update Manager

book

Article ID: 331437

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

This article describes the steps to disable any weak ciphers in Update Manager.


Resolution

  1. Navigate to the installation directory of Update Manager server. The default location is:
    C:\Program Files (x86)\VMware\Infrastructure\Update Manager

  • Take a backup of the jetty-vum-ssl.xml file before you edit it.

  • Open jetty-vum-ssl.xml file in a text editor.

  • Find the list of cipher suites in <Array type="java.lang.String"> tag inside <Set name="excludeCipherSuites">.

  • Add the weak cipher suite that you intend to disable in the <Item> tag.
    For example: If you want to disable TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 and TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, then:
    <Item><item>TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</Item</item>>
    <Item><item>TLS_DHE_RSA_WITH_AES_128_CBC_SHA256</Item</item>>

  • Restart the Update Manager service. See KB1039328 for more information on how to restart Update Manager.

Disabling the Diffie-hellman ciphers

To disable Diffie-hellman ciphers, disable the following ciphers:

  1. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  2. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256