Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

SSL cipher configuration

Updated: April 17, 2026

Want to summarize with AI?

Log in

Enable, disable, or remove Secure Sockets Layer (SSL) ciphers while retaining a valid cipher configuration for NGINX.

Review the requirements for modifying SSL cipher settings and preventing NGINX validation failures.

You can enable, disable, or remove SSL ciphers. Determine the required combination of ciphers before you modify the configuration.

Do not disable or remove all ciphers. A configuration that contains no enabled ciphers is invalid and causes NGINX validation to fail.

NGINX uses the OpenSSL cipher-list format. For information about this format, see the OpenSSL documentation.

Cisco APIC SSL option mappings to cipher-list formatting

Review how enabling, disabling, or removing a cipher changes the NGINX configuration.

The Cisco APIC maps SSL cipher options to the NGINX configuration as follows:

  • Enabling a cipher writes the cipher to the NGINX configuration file.

  • Disabling a cipher writes the cipher to the NGINX configuration file with a preceding exclamation mark ( ! ). For example, disabling EECDH writes !EECDH .

  • Removing a cipher omits the cipher from the NGINX configuration file.

Note

In the OpenSSL cipher-list format, the ! operator permanently removes matching ciphers from the list. A cipher that this operator removes cannot be added again by a later expression. As a result, disabling a cipher can also remove cipher combinations that reference it, even if those combinations are enabled.

Note

For example, disabling EECDH while enabling EECDH+aRSA+SHA384 writes !EECDH:EECDH+aRSA+SHA384 to the NGINX configuration file. The !EECDH expression prevents EECDH+aRSA+SHA384 from being added. If this configuration leaves no available ciphers, NGINX validation fails. NGINX updates, including the application of custom HTTPS certificates, also fail.

Cipher-list validation before an SSL configuration change

Use the openssl ciphers -V 'cipher-list' command to verify the cipher-list syntax before you modify the Cisco Application Policy Infrastructure Controller ( APIC ) configuration.

Before you modify the cipher configuration, test the planned cipher combination and verify that the command returns the expected ciphers.

apic# openssl ciphers -V 'EECDH+aRSA+SHA256:EECDH+aRSA+SHA384'
                0xC0,0x27 - ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256
                    0xC0,0x28 - ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384

If the command returns an error or no cipher match , do not apply the configuration to the Cisco APIC . An invalid cipher list can cause NGINX validation to fail, make the Cisco APIC GUI inaccessible, and prevent the application of custom certificates.

The following example shows an invalid cipher list:

apic# openssl ciphers -V '!EECDH:EECDH+aRSA+SHA256:EECDH+aRSA+SHA384'
                Error in cipher list
                    132809172158128:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:
                    no cipher match:ssl_lib.c:1383: