Cipher management is an optional feature that enables you to control the set of security ciphers that is allowed for every TLS and SSH connection. Cipher management allows you to disable weaker ciphers and thus enable a minimum level of security.
The Cipher Management page has no default values. Instead, the Cipher Management feature takes effect only when you configure the allowed ciphers. Certain weak ciphers are never allowed, even if they are configured on the Cipher Management page.
You can configure ciphers on the following TLS and SSH interfaces:
All TLS—The ciphers that are assigned in this field are applicable to all server and client connections that support the TLS protocol on Unified Communications Manager and IM and Presence Service.
HTTPS TLS—The ciphers that are assigned in this field are applicable to all Cisco Tomcat connections on ports 443 and 8443 that support the TLS protocol on Unified Communications Manager and IM and Presence Service.
If you assign ciphers on HTTPS TLS and All TLS fields, the ciphers that are configured on HTTPS TLS override All TLS ciphers.
SIP TLS—The ciphers that are assigned in this field are applicable to all encrypted connections to or from the SIP TLS interfaces that support the TLS protocol on Unified Communications Manager. It is not applicable for SCCP or CTI devices.
SIP interface in authenticated mode only supports NULL-SHA ciphers.
If you configure ciphers in the SIP interface or All interface, authenticated mode is no longer supported.
If you assign ciphers in SIP TLS and All TLS fields, then the ciphers you configured on SIP TLS override the All TLS ciphers.
SSH Ciphers—The ciphers that are assigned in this field are applicable to SSH connections on Unified Communications Manager and IM and Presence Service.
SSH Key Exchange—The Key Exchange algorithms that are assigned in this field are applicable to the SSH interface on Unified Communications Manager and IM and Presence Service.
Following are the points for negotiating the curves:
ECDSA ciphers are negotiated with different EC curves based on the key size of the ECDSA certificate.
The RSA ciphers are negotiated with all the EC curves irrespective of key size of the certificate.
The key size of a ECDSA certificate must be same as the curve size for the TLS negotiation to happen.
The 384 key certificate and ECDSA ciphers are negotiated, when the client offers P-384 EC curve.
Curve negotiation is based on the client preference for both RSA and ECDSA ciphers.
When the certificate size is 384 bits and client offerings are P-521, P-384, P-256 EC curves then TLS negotiation happen with the P-521 curve. Since curve offered by the client is P-521 at the first and P- 384 curve is also available on the list. When the certificate size is 384 bits and client offerings are P-521, P-256 EC curves then TLS negotiation will not happen because the P-384 curve is not offered by the client.
The following are the supported ciphers for EC curves:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
This section lists the recommended ciphers. Make sure that the ciphers configured are part of the recommended ciphers. Otherwise, you may encounter interoperability issues with other products over secure interfaces. After configuring the recommended ciphers, restart the affected services or reboot the server for the changes to take effect.
Configuring hmac-sha2-512 in SSH MAC interface affects the DRS and CDR functionality.
Configuring ciphers firstname.lastname@example.org, email@example.com in "SSH Cipher's" field or configuring only ecdh-sha2-nistp256 algorithm in "SSH KEX" will break the DRS and CDR functionalities.
We recommend the following cipher strings for the TLS and SSH interface configuration:
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384: ECDHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256: ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA
- SSH Ciphers
- SSH MAC
- SSH KEX for FIPS and Non-FIPS
ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "diffie-hellman-group14-sha1", "diffie-hellman-group16-sha512", "diffie-hellman-group14-sha256"