Retire the old TLS versions that use CBC ciphers
Why it matters
TLS 1.0 and 1.1 still accept CBC ciphers that were the target of the BEAST and Lucky13 attacks (Lucky13 also affects CBC in TLS 1.2). This is only informational because the real fix is switching the old protocol versions off.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Turn off TLS 1.0 and 1.1 as described in the fix for the legacy protocols finding. That removes these CBC suites with it.
- Check afterwards with the command below that only TLS 1.2 and 1.3 are accepted.
bash
nmap --script ssl-enum-ciphers -p 443 example.com The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.