# Weak ciphers being reported on penetration audit

**URL:** <https://forum.inductiveautomation.com/t/weak-ciphers-being-reported-on-penetration-audit/8910>\
**Category:** General Discussion\
**Created:** [August 15, 2014, 1:32pm UTC](https://forum.inductiveautomation.com/t/weak-ciphers-being-reported-on-penetration-audit/8910 "2014-08-15T13:32:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![diat150](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diat150](https://forum.inductiveautomation.com/u/diat150)\
**Post date:** [August 15, 2014, 1:32pm UTC](https://forum.inductiveautomation.com/t/weak-ciphers-being-reported-on-penetration-audit/8910/1 "2014-08-15T13:32:47Z")

</div>

ignition version 7.5.11

One of our customers IT team recently did an audit of their system and found weak ciphers being reported. I found an online scanner and ran a test on our internal system and found a similar result:

> [@](#):
>
> Cipher Suites (sorted by strength; the server has no preference)  
> TLS\_RSA\_EXPORT\_WITH\_RC4\_40\_MD5 (0x3) WEAK 40  
> TLS\_RSA\_EXPORT\_WITH\_DES40\_CBC\_SHA (0x8) WEAK 40  
> TLS\_DHE\_RSA\_EXPORT\_WITH\_DES40\_CBC\_SHA (0x14) DH 512 bits (p: 64, g: 64, Ys: 64) FS WEAK 40  
> TLS\_RSA\_WITH\_DES\_CBC\_SHA (0x9) WEAK 56  
> TLS\_DHE\_RSA\_WITH\_DES\_CBC\_SHA (0x15) DH 768 bits (p: 96, g: 96, Ys: 96) FS WEAK 56  
> TLS\_RSA\_WITH\_RC4\_128\_MD5 (0x4) 128  
> TLS\_RSA\_WITH\_RC4\_128\_SHA (0x5) 128  
> TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x2f) 128  
> TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x33) DH 768 bits (p: 96, g: 96, Ys: 96) FS WEAK 128  
> TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0xa) 112  
> TLS\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0x16) DH 768 bits (p: 96, g: 96, Ys: 96) FS WEAK 112  
> TLS\_RSA\_WITH\_DES\_CBC\_SHA (0x9) WEAK 56  
> TLS\_DHE\_RSA\_WITH\_DES\_CBC\_SHA (0x15) DH 768 bits (p: 96, g: 96, Ys: 96) FS WEAK 56  
> TLS\_RSA\_EXPORT\_WITH\_RC4\_40\_MD5 (0x3) WEAK 40  
> TLS\_RSA\_EXPORT\_WITH\_DES40\_CBC\_SHA (0x8) WEAK 40  
> TLS\_DHE\_RSA\_EXPORT\_WITH\_DES40\_CBC\_SHA (0x14) DH 512 bits (p: 64, g: 64, Ys: 64) FS WEAK 40

What can be done to rectify these weak ciphers? Is there a way to disable the weak ciphers? Is this something that was addressed in 7.6 or 7.7?

---

<div class="post-metadata">

**Author:** ![Sammy5](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@Sammy5](https://forum.inductiveautomation.com/u/Sammy5)\
**Post date:** [September 28, 2017, 1:03pm UTC](https://forum.inductiveautomation.com/t/weak-ciphers-being-reported-on-penetration-audit/8910/2 "2017-09-28T13:03:16Z")

</div>

I can not say how this may affect your Ignition version (our install is 7.9.4), but the solution I found was to go into the JAVA home directory/installation. There you will find file **java.security** under **/lib/security**. Look for **jdk.tls.disabledAlgorithms=** where you can add “DSA, DESede, DES”.

In the **ignition.conf** file I added the following lines:  
wrapper.java.additional.5=-DexcludedCiphers=SSLv3,TLSv1,DES-CBC3-SHA,DHE-RSA-DES-CBC3-SHA,DES,3DES, DESede, DES  
wrapper.java.additional.6=-Dciphers=TLS\_ECDH\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256

I now have DES, 3DES, SSL3 and TLS1 disabled.