Unsafe 3DES Cipher Suite im FHIR Proxy

[UKFr-DIZ]

Hi,

I've been informed by our security team that we are still supporting an insecure cipher suite. They directed me to the standards at https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices.

After reviewing, I noticed that a 3DES cipher suite is still being supported, which should be removed according to the best practice recommendations.

As a result, I suggest removing this cipher suite from the ssl.conf. Please refer to the SSLCipherSuite and SSLProxyCipherSuite directives.

Source:

dsf/dsf-docker/fhir_proxy/conf/extra/httpd-ssl.conf

Line 68 in 74eb4d7

SSLCipherSuite SSL ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:AES128-SHA:DES-CBC3-SHA

Best regards,
Nam

[schwzr]

Suggestion of which cipher suites to support:

https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1k&guideline=5.7