Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

SSL ciphers and TLS protocol support

Updated: April 17, 2026

Want to summarize with AI?

Log in

Clients that access the Cisco Application Centric Infrastructure (ACI) REST API over HTTPS must support an enabled protocol version and cipher.

Hypertext Transfer Protocol Secure (HTTPS) uses Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to secure an HTTP session.

  • SSL and TLS encrypt traffic between a client and an HTTP server.

  • The server certificate enables the client to verify the identity of the HTTPS server.

SSL and TLS protocol versions

HTTPS security depends on the enabled cipher suites and the security of the underlying protocol version. The protocol versions are categorized as follows:

  • Insecure protocol versions: SSLv1, SSLv2, and SSLv3.

  • Supported secure protocol versions: TLSv1.1 and TLSv1.2.

Browser clients typically negotiate a supported TLS version automatically. Configure nonbrowser clients, such as Java applications and Python scripts, to negotiate an enabled secure protocol version when they connect to the web server.

Determine supported SSL ciphers by using the CLI

Before you begin

Obtain access to a command-line environment that has OpenSSL and a text-processing utility such as sed installed.

Procedure

  1. List the ciphers that the local OpenSSL environment supports.

    Example:

    openssl ciphers 'ALL:eNULL'

  2. Format the output so that each cipher appears on a separate line.

    Example:

    openssl ciphers 'ALL:eNULL' | sed -e 's/:/\n/g'

  3. Test each cipher against the Cisco APIC HTTPS port.

    Repeat the command for each cipher that you want to test.

    Note

    Verify that the output reports a successful TLS handshake and identifies the negotiated cipher. The CONNECTED message alone confirms only that the TCP connection was established.

    Example:

    Use the following command:

    openssl s_client -cipher '<cipher-name>' -connect <apic-ip-address>:<ssl-port>

    The SSL port is typically 443. The following example tests the ECDHE-ECDSA-AES128-GCM-SHA256 cipher:

    openssl s_client -cipher 'ECDHE-ECDSA-AES128-GCM-SHA256' -connect 10.1.1.14:443