Outlines HTTPS server security configurations that enforce advanced cryptographic protocols, ensure NDcPP v4.0 compliance, and allow administrators to restrict access to modern TLS versions and secure cipher suites for enhanced data protection.

HTTPS server security configurations are security standards for the Cisco web-based management interface that

enforce advanced cryptographic protocols for client-server communication
align with NDcPP v4.0 certification requirements for enhanced data protection, and
allow administrators to restrict usage to modern TLS versions and secure cipher suites.

These configurations replace legacy default settings by mandating the use of secure elliptic curves and high-strength encryption algorithms, thereby reducing the attack surface of the web management interface.

Feature history

Table 1. Feature history for HTTPS server security considerations with NDcPP 4.0
Feature Name	Release Information	Feature Description
HTTPS server security considerations with NDcPP 4.0	Cisco IOS XE 26.2.1	This feature hardens the Cisco web-based management interface by enforcing advanced cryptographic protocols for client-server communication, ensuring alignment with NDcPP v4.0 certification requirements for robust data protection while providing administrators with granular control to restrict interface access to modern TLS versions and secure cipher suites.

Best practices for HTTPS server security

Ensure that you maintain a secure management interface using these guidelines:

Enforce TLS 1.3: Configure the HTTPS server to exclusively use TLS 1.3 to ensure the highest level of connection security.
Maintain updated curves: Use the secp384r1 curve for ECDHE key exchange to align your device with current industry security standards
Validate configurations: Verify your security policy settings immediately after any changes by executing the show ip http server secure status command to confirm that the active settings are correctly applied.

Configure HTTP server security settings (CLI)

Configure network device HTTP server security to ensure management access is encrypted and resilient to modern security threats.

Perform this task when securing web-based device access, or after a security audit recommends updating transport security standards.

Procedure

Enter the global configuration mode.
Example:
```
Device# configure terminal
```

Specify the allowed TLS version.

Example:

Device(config)# ip http tls-version TLSv1.3

Set the secure cipher suite.

Example:

Device(config)# ip http secure-ciphersuite tls13-aes256-gcm-sha384

Configure the default elliptic curve for key exchange.
Example:
```
Device(config)# ip http secure-ecdhe-curve secp384r1
```
Verify the current security status.
Example:
```
Device# show ip http server secure status
```

Device web management interfaces now enforce strong encryption and current best-practice TLS configuration.

Configure HTTP client security settings (CLI)

Configure network device HTTP client security to ensure management access is encrypted and resilient to modern security threats.

Perform this task when securing web-based device access, or after a security audit recommends updating transport security standards.

Procedure

Enter the global configuration mode.
Example:
```
Device# configure terminal
```

Specify the allowed TLS version.

Example:

Device(config)# ip http client tls-version TLSv1.3

Set the secure cipher suite.

Example:

Device(config)# ip http client secure-ciphersuite tls13-aes256-gcm-sha384

Verify the current security status.
Example:
```
Device# show ip http client secure status
```

Device web management interfaces now enforce strong encryption and current best-practice TLS configuration.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.