/usr/share/pki/server/conf/ciphers.info is in pki-server 10.6.0-1ubuntu2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 | ##
# BEGIN COPYRIGHT BLOCK
# Copyright (C) 2015 Red Hat, Inc.
# All rights reserved.
# END COPYRIGHT BLOCK
#
# This file contains the default sslRangeCiphers that come with this version of
# the PKI software in its <instance>/conf/server.xml file.
#
# Depending on which kind of SSL server you have, you want to reference the
# corresponding cipher suite for making adjustments to your instance
# server.xml.
#
#
# About the TLS range related parameters:
#
# 'sslVersionRangeStream'
# 'sslVersionRangeDatagram'
# 'sslRangeCiphers'
#
# The default sslVersionRangeStream and sslVersionRangeDatagram
# parameters contain values that are supported by the native NSS.
# Changes can be made to restrict or relax the support.
#
# The default sslRangeCiphers parameter contains a list of ciphers best
# suited for the type of the server installed. Changes can be made to
# suit each site's needs.
#
# Although TLS1.2 ciphers (SHA256) are preferred, many older clients
# do not support them. For example, the following "preferred modern"
# ciphers are on by default, and by simply limiting the
# sslVersionRange* parameters, they can be turned off.
#
# TLS_RSA_WITH_AES_128_CBC_SHA256,
# TLS_RSA_WITH_AES_256_CBC_SHA256,
# TLS_RSA_WITH_AES_128_GCM_SHA256,
# TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
# TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
#
# The TLS_ECDHE_RSA_* ciphers provide Perfect Forward Secrecy,
# which, while provide added security to the already secure and adequate
# TLS_RSA_* ciphers, requires 3 times longer to establish SSL sessions.
# In our testing environment, some HSM might also have issues providing
# subsystem->subsystem SSL handshake. We are therefore turning them
# off by default. One can enable them manually by turning the "-" to
# "+" under sslRangeCiphers and restart the subsystem.
#
# TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
# TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
# TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
# TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
# TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
#
# The following ciphers are supported in RHEL 7.2 or greater, and
# are turned on by default. They can be turned off by sites running
# older versions of RHEL:
#
# TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
# TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
# TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
# TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
# TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
# TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
#
# The following somewhat weaker ciphers (in CBC mode), though
# adequate for the CS operations, can be turned off if so desired:
#
# TLS_RSA_WITH_AES_128_CBC_SHA,
# TLS_RSA_WITH_AES_256_CBC_SHA,
#
# Note: In an EC CS server setup, you will see by default that the
# following RSA ciphers are left on. Those are used for
# installation where the actual systems certs have not yet been
# created, and a temporary RSA ssl server cert is at play.
#
# Those can be turned off manually by sites.
#
# TLS_RSA_WITH_AES_256_CBC_SHA256,
# TLS_RSA_WITH_AES_128_GCM_SHA256
#
# These ciphers might be removed by the installation script in
# some future release.
#
# For RHEL 7.5 or greater:
#
# * all '3DES' ciphers have been disabled,
# * the default sslVersionRangeStream and
# sslVersionRangeDatagram ranges have been upgraded to
# only allow ciphers in the TLS1.1 to TLS1.2 range, and
# * the default sslRangeCiphers values have been altered to
# include all recommended 'FIPS' ciphers for both RSA and ECC
# servers regardless of whether 'FIPS' is enabled or disabled
#
# Default ciphers enabled for RSA servers:
#
# +TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
# +TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
# +TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
# +TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
# +TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
# +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
# +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
# +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
# +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
# +TLS_RSA_WITH_AES_128_CBC_SHA256,
# +TLS_RSA_WITH_AES_256_CBC_SHA256,
# +TLS_RSA_WITH_AES_128_CBC_SHA,
# +TLS_RSA_WITH_AES_256_CBC_SHA
#
# NOTE: The last two ciphers, TLS_RSA_WITH_AES_128_CBC_SHA,
# and TLS_RSA_WITH_AES_256_CBC_SHA, may need to remain
# enabled in order to talk to the LDAP server
# during pkispawn installation/configuration.
#
# Default ciphers enabled for ECC servers:
#
# +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
# +TLS_RSA_WITH_AES_256_CBC_SHA,
# +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
# +TLS_RSA_WITH_AES_256_CBC_SHA256,
# +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
# +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
#
##
# For RSA servers:
sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA"
#
#
# For ECC servers:
sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|