Tutorial: Harden the Web Server Cipher Suite String⁠

1. Connect to your console and get root privileges.

2. Run the following sacli command:

   cd /usr/local/openvpn_as/scripts/
   ./sacli ConfigQuery | grep -i "cs.openssl_ciphersuites"

   • The default above applies if nothing shows OR the output displays the cipher suite string you've set.

1. Run the following sacli commands to set a custom string (using your preferred cipher suite string values in place of ours):

   ./sacli --key "cs.openssl_ciphersuites" --value 'DEFAULT:!MEDIUM:!LOW:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA' ConfigPut
   ./sacli start

If you've set the cipher suite string using the commands above, you can delete the configuration key to restore it to the default settings.

1. Run the following sacli commands to delete the configuration key and reset to the default cipher suite string setting:

   ./sacli --key "cs.openssl_ciphersuites" ConfigDel
   ./sacli start

In these versions, inter-node communication had a separate configuration key for its cipher suite string, ssl_api.openssl_ciphersuites. By default, it inherited the settings from the main web services.

1. Verify the ciphers your web server supports using the nmap tool:

   nmap --script ssl-enum-ciphers -p 443 vpnserver.yourdomain.com

2. To manually specify the cluster cipher suite string( for versions before 3.0.0), run the following sacli commands:

   ./sacli --key "ssl_api.openssl_ciphersuites" --value 'DEFAULT:!MEDIUM:!LOW:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA' ConfigPut
   ./sacli start

If you've set the cluster cipher suite string separately using the commands above, you can delete the configuration key to restore it to the default settings.

1. Run the following sacli commands to delete the configuration key:

   ./sacli --key "ssl_api.openssl_ciphersuites" ConfigDel