Sweet32,3DES, SHA1,RC4, disable, using "RSA certificate" with SSL/TLS profile

[Metgatz]

Sweet32,3DES, SHA1,RC4, disable, using "RSA certificate" with SSL/TLS profile

Hello good evening, as always thank you very much for your support, please help me to clarify an issue related to weak encryption of TLS/SSL Web-gui using rsa certificate to disable 3DES, SHA1 and RC4, of an SSL/TLS profile for WEB-GUI access and continue negotiating only with strong algorithms.

This is the reference link:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC 

With the following commands 3DES,SHA1 and RC4 are disabled:

That is explicit commands that disable 3des,sha1 and RC4 ( TLSprofileTest is an example of SSL/TLS profile):

set shared ssl-tls-service-profile TLSprofileTest protocol-settings enc-algo-3des no

set shared ssl-tls-service-profile TLSprofileTest protocol-settings auth-algo-sha1 no

set ssl-tls-service-profile TLSprofileTestprotocol-settings enc-algo-rc4 no

Now the question is the following, please answer as precisely as possible:

-When disabling the weak encryption and authentication algorithms with the "NO" option (previously detailed commands), is it necessary, should or is it required to explicitly set the strong algorithms as "YES"? or the firewall assumes, that by setting "NO" to the weak ones, the firewall will automatically negotiate with all other algorithms, except the ones that were declared as "NO" ( 3DES,SHA1 AND RC4 ).

I remain attentive, cordial greetings and attentive to your comments.

[OtakarKlier · Accepted solution]

Hello,

You do not need to set the others to yes, they are all enabled and you are just disabling the weak ones.

Hope this helps.