Configuring the transport layer security cipher list using the CLI

Prev Next

Use the CLI commands in this procedure to configure the TLS cipher list that you want to assign to a TLS connection on the appliance. The cipher list is used for X.509 (TLS/SSL) certificates.

Note

You can configure the TLS cipher list only using the CLI.

The following cipher lists are available:

  • fips — Compliant with FIPS 140-2 certification.

  • cc-ndcpp — Compliant with the Common Criteria (CC-NDPP) certification.

  • fips-and-cc-ndcpp — Compliant with both FIPS and CC-NDPP certifications.

  • fips-high-security — Compliant with FIPS 140-2 certification, and excludes low-security ciphers.

  • cc-ndcpp-high-security — Compliant with CC-NDPP certification, and excludes low-security ciphers.

  • fips-and-cc-ndcpp-high-security — Compliant with both FIPS and CC-NDPP certifications, and excludes low-security ciphers.

  • compatible — Improved security while maintaining backward compatibility

Prerequisites

  • An established connection between the Email Security - Server appliance and the Internet.

  • You are logged in to the Email Security - Server appliance CLI as an Admin or Operator.

To configure the TLS cipher list:
  1. Go to CLI configuration mode.

    hostname > enable
    hostname # configure terminal
  2. Specify the TLS cipher list.

    hostname (config) # email-analysis tls cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-highsecurity | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
  3. Verify the TLS cipher list configuration for X.509 (TLS/SSL) certificates.

    hostname (config) # show email-analysis
    Email-Analysis:
      enabled:                   yes
      mode:                      monitor
      interface:                 pether3
      TLS receive mode:          none
      TLS default deliv. mode:   none
      MTA certificate name:      system-self-signed
      Password-protected objs:   yes
      cipher list:               compatible
      minimum protocol version:  tls1
      Controlled-live-mode enabled: no
      URL dynamic analysis enabled: yes
      .
      .
      .

    The "cipher list" line displays the TLS cipher list configuration.

  4. Save your changes.

    hostname (config) # write memory