How to Disable Legacy CBC-Mode TLS Cipher Suites on VMware ESXi 8.x

Products

• VMware vSphere ESXi

Issue/Introduction

• During security assessments, ESXi hosts may be flagged for supporting legacy CBC-mode TLS cipher suites, such as TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA.
• While modern AES-GCM cipher suites are supported, the continued availability of CBC-mode ciphers and SHA-1 message authentication allows for the negotiation of older cryptographic algorithms.
• This article provides instructions to harden TLS configurations to comply with modern security requirements.

Environment

• Product: VMware vSphere ESXi
• Version: 8.0 Update 3+
• Configuration: Standard ESXi host security configuration.

Cause

• The default cryptographic configuration on ESXi hosts permits the negotiation of legacy cipher suites for backward compatibility.
• Security compliance policies often require the exclusive use of stronger, non-CBC-mode cipher suites (such as AES-GCM or ChaCha20-Poly1305) when TLS 1.2 is utilized.

Resolution

To restrict the cipher list, follow the steps below:

1. Place ESXi host in Maintenance Mode
2. SSH to ESXi host 
3. Type " esxcli system tls server get" to copy the baseline profile/config
4. Run the following commands:
   1. esxcli system tls server set -p MANUAL --cipher-list="ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"
   2. esxcli system tls server set -p MANUAL --cipher-suite="TLS_AES_256_GCM_SHA384"
5. Reboot the ESX host for the change to take affect. 
6. Test using openssl command from same ESX host and verify the Cipher used:
   

   openssl s_client -connect localhost:443

   Example snippet from OPENSSL command:

   New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
   Server public key is 2048 bit
   Secure Renegotiation IS supported
   Compression: NONE
   Expansion: NONE
   No ALPN negotiated
   SSL-Session:
       Protocol  : TLSv1.2
       Cipher    : ECDHE-RSA-AES256-GCM-SHA384

Additional Information

• Disable weak CBC ciphers - VMware vSphere