Use the CLI commands in this procedure to configure the TLS cipher list that you want to assign to a TLS connection on the appliance. The cipher list is used for X.509 (TLS/SSL) certificates.
Note
You can configure the TLS cipher list only using the CLI.
The following cipher lists are available:
fips— Compliant with FIPS 140-2 certification.cc-ndcpp— Compliant with the Common Criteria (CC-NDPP) certification.fips-and-cc-ndcpp— Compliant with both FIPS and CC-NDPP certifications.fips-high-security— Compliant with FIPS 140-2 certification, and excludes low-security ciphers.cc-ndcpp-high-security— Compliant with CC-NDPP certification, and excludes low-security ciphers.fips-and-cc-ndcpp-high-security— Compliant with both FIPS and CC-NDPP certifications, and excludes low-security ciphers.compatible— Improved security while maintaining backward compatibility
Prerequisites
An established connection between the Email Security - Server appliance and the Internet.
You are logged in to the Email Security - Server appliance CLI as an Admin or Operator.
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Specify the TLS cipher list.
hostname (config) # email-analysis tls cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-highsecurity | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}Verify the TLS cipher list configuration for X.509 (TLS/SSL) certificates.
hostname (config) # show email-analysis Email-Analysis: enabled: yes mode: monitor interface: pether3 TLS receive mode: none TLS default deliv. mode: none MTA certificate name: system-self-signed Password-protected objs: yes cipher list: compatible minimum protocol version: tls1 Controlled-live-mode enabled: no URL dynamic analysis enabled: yes . . .
The "cipher list" line displays the TLS cipher list configuration.
Save your changes.
hostname (config) # write memory