Disable weak CBC ciphers - VMware vSphere

Products

• VMware vSphere ESXi
• VMware vCenter Server
• VMware Cloud Foundation

Issue/Introduction

• Security vulnerability scanners flag active Cipher Block Chaining (CBC) ciphers on ESXi 8.0 U3+ hosts and vCenter Server Appliance (vCSA) 8.0 U3+.
  
  
• To meet internal security compliance baselines, restrict active TLS ciphers by enabling the NIST_2024 profile.
  
  
• Security scans may report "Weak Message Authentication Code Cipher Suites" or "Weak Encryption Cipher Suites" on ESXi for port 443. The scan typically flags one or more of the following CBC ciphers:
  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  • TLS_RSA_WITH_AES_128_CBC_SHA
  • TLS_RSA_WITH_AES_256_CBC_SHA
    
    
• Security audits flag port 443 on ESXi hosts or vCenter Server.
  
  
• Compliance requirements (e.g., NIST) require disabling static key ciphers.

Environment

• VMware vSphere ESXi 8.0 U3 and later
• VMware vCenter Server: 8.0U3, 8.0U3i
• VCF: 5.2.3

Cause

• vSphere 8.0 U3 and higher default to the COMPATIBLE TLS profile.
  
  
• This profile permits CBC ciphers and older cryptographic algorithms to maintain interoperability across legacy environments.

Resolution

1. To remove flagged CBC ciphers, set the TLS profile to NIST_2024.
   
   
2. Warning: Restricting ciphers can impact compatibility with third-party solutions. Review vendor documentation for supported ciphers before proceeding.
   
   
3. For ESXi 8.0 U3 and later (port 443)
   
   1. Establish an SSH session to the ESXi host as root
   
   2. Review the current profile:

   esxcli system tls server get

   
   3. Set the TLS profile to NIST_2024:

   esxcli system tls server set -p NIST_2024

   
   4. Place the host in Maintenance Mode.
   
   5. Reboot the ESXi host to apply changes.
   
   6. Exit Maintenance Mode.
   
   
4. For ESXi 8.0 U3 and later (Port 5989 - WBEM)
   
   If scans continue to flag port 5989, manually set the WBEM cipher list:
   
   1.    Establish an SSH session to the ESXi host as root.
   
   2.    Set the strong cipher list for WBEM:

   esxcli system wbem set --ssl-cipher-list=!aNULL:ECDHE+AESGCM

5. For vCenter Server 8.0 U3 and later
   
   1. Establish an SSH session to the vCenter Server Appliance (vCSA).
   
   2. Use the following command to set the TLS profile:

   vcli tls server set -p NIST_2024 (Note: Alternatively, use the vSphere API to update the TLS profile).

   3. Restart the rhttpproxy service or reboot the appliance to ensure all services inherit the new profile:

   service-control --restart vmware-rhttpproxy

 

Additional Information

• For older ESXi versions (8.0 U1/U2), refer to KB 312031 - Disable weak ciphers on Esxi 8.0, 8.0 U1 and 8.0 U2
  
  
• For legacy vCenter builds, refer to KB 322335 - Disabling static ciphers for TLS in the vCenter Server appliance (Legacy builds only)
  
  
• To speak to a Technical Support Engineer, see KB 206567 - Contact Broadcom support