For Workers & Pages, what is the name of the domain?
veroit.app
What is the error number?
Disable weak cipher not working
What is the error message?
I’m trying to disable insecure ciphers on tls 1.2, but when I check they remain enabled
What is the issue or error you’re encountering
I’m trying to disable insecure ciphers on tls 1.2, but when I check they remain enabled. I have a Pro Plan and ACM. Universal SSL are disabled.
What are the steps to reproduce the issue?
Step 1
curl -X PATCH “https://api.cloudflare.com/client/v4/zones/XXXXXXXXXXXXXXXXXX/settings/ciphers”
-H “X-Auth-Email: XXXXXXXXXXXXXXXXXXX”
-H “X-Auth-Key: XXXXXXXXXXXXXXXXXXXXXXXX”
-H “Content-Type: application/json”
-d ‘{ “value”: }’
Step 2
curl -X PATCH “https://api.cloudflare.com/client/v4/zones/XXXXXXXXXXXXXXXXXX/settings/ciphers”
-H “X-Auth-Email: XXXXXXXXXXXXXXXXXXX”
-H “X-Auth-Key: XXXXXXXXXXXXXXXXXXXXXXXX”
-H “Content-Type: application/json”
-d ‘{
“value”: [
“ECDHE-ECDSA-AES128-GCM-SHA256”,
“ECDHE-ECDSA-CHACHA20-POLY1305”,
“ECDHE-ECDSA-AES128-SHA”,
“ECDHE-ECDSA-AES256-GCM-SHA384”,
“ECDHE-ECDSA-AES128-SHA256”,
“ECDHE-ECDSA-AES256-SHA384”,
“ECDHE-RSA-AES128-GCM-SHA256”,
“AES128-GCM-SHA256”,
“ECDHE-RSA-AES256-GCM-SHA384”,
“AES256-GCM-SHA384”
]
}’
Step 3
curl -X GET “https://api.cloudflare.com/client/v4/zones/XXXXXXXXXXXXXXXXXX/settings/ciphers”
-H “X-Auth-Email: XXXXXXXXXXXXXXXXXXX”
-H “X-Auth-Key: XXXXXXXXXXXXXXXXXXXXXXXX” \
Result:
{“result”:{“id”:“ciphers”,“value”:[“ECDHE-RSA-CHACHA20-POLY1305”,“ECDHE-ECDSA-AES128-GCM-SHA256”,“ECDHE-ECDSA-CHACHA20-POLY1305”,“ECDHE-ECDSA-AES128-SHA”,“ECDHE-ECDSA-AES256-GCM-SHA384”,“ECDHE-ECDSA-AES128-SHA256”,“ECDHE-ECDSA-AES256-SHA384”,“ECDHE-RSA-AES128-GCM-SHA256”,“AES128-GCM-SHA256”,“ECDHE-RSA-AES256-GCM-SHA384”,“AES256-GCM-SHA384”],“modified_on”:null,“editable”:true},“success”:true,“errors”:,“messages”:}
Testing:
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-ECDSA-AES128-GCM-SHA256” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-ECDSA-CHACHA20-POLY1305” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-ECDSA-AES128-SHA” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-ECDSA-AES256-GCM-SHA384” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-ECDSA-AES128-SHA256” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-ECDSA-AES256-SHA384” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-RSA-AES128-GCM-SHA256” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “AES128-GCM-SHA256” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “ECDHE-RSA-AES256-GCM-SHA384” -tls1_2
Result: ENABLED
Executed command: openssl s_client -connect “veroit.app:443” -cipher “AES256-GCM-SHA384” -tls1_2
Result: ENABLED
