Need to disable weak ciphers in vCenter 8.0.2d for port 443

Products

• VMware vCenter Server

Issue/Introduction

• Customer's internal vulnerability scanning listing the ciphers as needing to be disabled to meet company security policies.

Environment

VMware vCenter Server 8.0 U2d to U3

Cause

vCenter server 8.0 U2d up to 8.0 U3 requires different configurations to disable the ciphers than previous builds and builds of U3 and beyond.

Resolution

If the environment will allow it, it is better is upgrade to at least the latest 8.0 U3 build to utilize the newer method of managing ciphers.

===============================================================

Follow the below steps to disable the weak ciphers.

1. Save the old settings:
   
   cp /etc/applmgmt/appliance/tls_settings.yaml /etc/applmgmt/appliance/tls_settings.yaml.bak

2. Open this file:
   
   vim /etc/applmgmt/appliance/tls_settings.yaml (or use “vi” tool depending on your preference)

3. Delete all lines, containing the offending ciphers:
   > - ECDHE-RSA-AES256-SHA
   > - ECDHE-RSA-AES128-SHA
   > - AES256-SHA
   > - AES128-SHA
   
   Note: The ciphers are listed twice, for each supported TLS profile. Need to remove them from both profiles.

4. Save the file (type “:” then “wq!”).

5. Run this command to propagate the edited configuration:
   
   python3 /usr/lib/applmgmt/support/scripts/tls_profiles/update_tls_profiles.py -p COMPATIBLE --upgrade

6. Restart rhttpproxy service:
   
   service-control --restart rhttpproxy

7. Optional - Delete the backup file if not needed anymore:
   
   rm /etc/applmgmt/appliance/tls_settings.yaml.bak

Additional Information

• VCSA 8.0 U3 and later - Configure vCenter TLS Profiles to Disable Weak Cipher Suites
• Additional details about the ciphers - Disabling static ciphers for TLS in the vCenter Server appliance (Legacy builds only)