Change the Security Protocols and Cipher Suites Used for TLS or SSL Communication

Although in almost all cases, the default settings do not need to be changed, you can configure the security protocols and cryptographic algorithms that are used to encrypt communications between clients and the Unified Access Gateway appliance.

The default setting includes cipher suites that use either 128-bit or 256-bit AES encryption, except for anonymous DH algorithms, and sorts them by strength. By default, TLS v1.2 is enabled.

Procedure

1. Call the GET /v1/config/system API.

   Example

   curl -k -u admin -o ~/ciphers.json https://uag-ip-or-hostname:9443/rest/v1/config/system

2. In the JSON response, update the protocols and cipher suites to use.

   The following JSON sample has the default TLS cipher suites and protocols settings for non-FIPS Unified Access Gateway.

   {
   "cipherSuites": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256",
     "tls12Enabled": "true",
     "tls13Enabled": "true"
   }
   

   Default values for FIPS

   {
   "cipherSuites": 
   "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
   "tls12Enabled": "true",
   "tls13Enabled": "false"
   }
   

3. Use a REST client, such as curl or postman, to use the JSON request to invoke the Unified Access Gateway REST API and configure the protocols and cipher suites.

   In the example, uag-ip-or-hostname is the fully qualified domain name of the Unified Access Gateway appliance.

   curl -k -d @- -u 'admin' -H "Content-Type: application/json" -X PUT https://uag-ip-or-hostname:9443/rest/v1/config/system < ~/ciphers.json
   

   Where, ciphers.json is the JSON request you created in the previous step.

Results

The cipher suites and protocols that you specified are used.