Page 1 of 1

How to disable weak or medium SSL ciphers?

Posted: Mon Mar 18, 2013 5:39 am
by FTP
If you failed a PCI Compliance scan, it doesn't matter, if you care about it, you can disable weak and medium SSL ciphers in Wing FTP Server, just enable FIPS 140-2 mode and disable TLS v1.0/TLS v1.1 under "Server > Settings > General Settings > Security", then Wing FTP Server will use the algorithms which be approved by the FIPS group (only allows strong SSL ciphers). And you can also enter the strongest cipher suites under "Server > Settings > General Settings > Security > OpenSSL Cipher Suites":

Code: Select all



After you change this option, you need to restart the WingFTP service.

Now you can test the strength of the SSL ciphers again, you can test it with openssl tool, most Linux system will install openssl by default, Windows users can download it from here:" rel="nofollow" rel="nofollow

You can type the following commands to check whether the server supports weak or medium SSL ciphers:

Code: Select all

openssl s_client -connect -cipher EXP:LOW
openssl s_client -connect -cipher EXP:MEDIUM
If weak or medium SSL ciphers are not supported, you will get an error like this:

Code: Select all

140004449822376:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
Otherwise, you will get a result like this:

Code: Select all

depth=1 /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - G2