I am unable to disable certain 128 bit TLS 1.3 ciphers in HAProxy. With the OpenSSL command line you have to split the cipher string in two parts for disabling default TLS 1.3 ciphers. One part for TLS 1.3 with paramter -ciphersuites and another part for TLS 1.2 and lower without paramter. Is it pos…

Yeah, that’s seems like a stupid thing for SSLlabs todo … Here some open github issues for SSLlabs to fix this: [image] Issue: Allow better cipher strength score with GCM AES128 (mandatory in HTTP/2) opened by fdelapena on 2017-03-01 It is technically impossible to handle…

Disable certain TLS 1.3 ciphers in haproxy.cfg

Help!

lukastribus August 5, 2018, 10:00am 4

Yeah, that’s seems like a stupid thing for SSLlabs todo …

Here some open github issues for SSLlabs to fix this:

Topic		Replies	Views
Haproxy 2.04 with openssl 1.1.1 TLS 1.3 not working Help!	25	8438	August 14, 2019
Trouble with getting TLS 1.3 working on Ubuntu 16.04 Help!	2	1832	February 24, 2020
TLS1.3 is not enabled on Haproxy 2.0.3 with upgraded Openssl 1.1.1c- OS CentOS7 Help!	21	7484	May 12, 2021
How to disable TLS v1.0 & v1.1 in HAProxy? Help!	14	15050	February 25, 2023
Enable TLS 1.0 & TLS 1.1 in haproxy 2.4 Help!	3	3143	March 28, 2023

Disable certain TLS 1.3 ciphers in haproxy.cfg

Related topics