Home  Prev  cOS Core 15.00.06 Administration Guide  Next

14.9. SSL Settings

These global settings affect the operation of both OneConnect VPN, SSL VPN and the TLS ALG (see Section 11.6, SSL VPN, Section 6.1.11, TLS ALG and Section 11.7, OneConnect VPN). In addition, the cOS Core management Web Interface is affected.

Recommendations

For services with clients that support TLS 1.3 and do not require backward compatibility, it is recommended to disable all cipher suites except those available for TLS 1.3.

For services with slightly older clients, it is recommended to enable the cipher suites listed in the Intermediate section.

For services with legacy clients, it may be necessary to enable some of the cipher suites listed in the Old TLS 1.2 Cipher Suites section. Enabling these cipher suites is strongly discouraged, as they are considered weak. Updating the clients to support more modern cipher suites is strongly recommended.

Description of Cipher Suites

The older TLS 1.2 standard describes cipher suites using a single string that contains both the Key Exchange Algorithm and the Payload Cipher. The newer TLS 1.3 standard separates the key exchange algorithm from the payload cipher.

TLSv1.3 Key Exchange Algorithms

Recommended TLS1.3 Cipher Suites

Intermediate TLS1.2 Cipher Suites

Old TLS1.2 Cipher Suites

Home  Prev   Next