# Ignition Security - disable TLSv1 **URL:** \ **Category:** Ignition\ **Created:** [June 19, 2017, 5:58pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558 "2017-06-19T17:58:10Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Sammy5](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@Sammy5](https://forum.inductiveautomation.com/u/Sammy5)\ **Post date:** [June 19, 2017, 5:58pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/1 "2017-06-19T17:58:10Z")
Is it currently possible to disable TLSv1 and only use 1.1 or 1.2? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 19, 2017, 6:01pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/2 "2017-06-19T18:01:21Z")
Yes, you can add the following JVM flag to ignition.conf and restart the gateway: `-DexcludedCiphers=TLSv1` This accepts a comma-separated list of exclusions if you need to exclude more. ---
**Author:** ![KathyApplebaum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kathyapplebaum/32/7261_2.png) [@KathyApplebaum](https://forum.inductiveautomation.com/u/KathyApplebaum)\ **Post date:** [June 19, 2017, 7:58pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/3 "2017-06-19T19:58:02Z")
Just be aware that if you disable TLSv1, you won’t be able to use any clients running on Java 6. ---
**Author:** ![Sammy5](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@Sammy5](https://forum.inductiveautomation.com/u/Sammy5)\ **Post date:** [June 20, 2017, 1:24pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/4 "2017-06-20T13:24:45Z")
The "-DexcludedCiphers=TLSv1" exclude worked, and yes by disabling TLSv1 it also insures the client end to upgrade their Java as well so that is not a problem. Now one other issue I have found. Previously I had the following; wrapper.java.additional.6=-\> Dciphers=TLS\_ECDH\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256 However when doing Digicert lookup it showed the following; > TLS\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA > TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA > Which I would not want enabled. This is in /etc/ignition/ignition.conf. Is there another config file where it is reading the ciphers to use? ---
**Author:** ![KathyApplebaum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kathyapplebaum/32/7261_2.png) [@KathyApplebaum](https://forum.inductiveautomation.com/u/KathyApplebaum)\ **Post date:** [June 20, 2017, 1:30pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/5 "2017-06-20T13:30:02Z")
No, there’s no other file. However, you can include **both** ciphers and protocols in your excluded ciphers list, as comma separated values. ---
**Author:** ![Sammy5](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@Sammy5](https://forum.inductiveautomation.com/u/Sammy5)\ **Post date:** [June 20, 2017, 1:46pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/6 "2017-06-20T13:46:38Z")
Kathy thanks for a quick reply! I think I am doing something wrong, because the following ciphers are still showing up (or the test is wrong). I am using [https://cryptoreport.websecurity.symantec.com/checker/](https://cryptoreport.websecurity.symantec.com/checker/) for a quick test. What I have in ignition.conf exactly is; wrapper.java.additional.8=-Dciphers=TLS\_ECDH\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256 wrapper.java.additional.8=-DexcludedCiphers=TLSv1,TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA,TLS\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA This is ideally what I am targeting, but I am still showing after restart: Cipher suites enabled: TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0x000A) TLS\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0x0016) Should I include the ciphers on a separate line from the protocol exclusion? ---
**Author:** ![KathyApplebaum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kathyapplebaum/32/7261_2.png) [@KathyApplebaum](https://forum.inductiveautomation.com/u/KathyApplebaum)\ **Post date:** [June 20, 2017, 5:58pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/7 "2017-06-20T17:58:44Z")
Looks like those two are supported by TLS v1.2, so yeah, you’ll need to exclude them specifically. Exclude them on the same line, but IIRC sometimes you need to use an alias, so also try excluding DES-CBC3-SHA and DHE-RSA-DES-CBC3-SHA to see if that helps. ---
**Author:** ![Sammy5](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@Sammy5](https://forum.inductiveautomation.com/u/Sammy5)\ **Post date:** [June 26, 2017, 1:26pm UTC](https://forum.inductiveautomation.com/t/ignition-security-disable-tlsv1/14558/8 "2017-06-26T13:26:18Z")
So I have now tried this; wrapper.java.additional.5=-DexcludedCiphers=TLSv1,DES-CBC3-SHA,DHE-RSA-DES-CBC3-SHA While TLSv1 is now disabled, ssl security scan shows that DES and 3DES are still an option. Is there another method or am I possibly using the wrong name for the ciphers?