Disable TLS v1.1 without going for CNSA cryptography mode

[Manu]

Hello,

Changing to CNSA cryptograpy has numerous consequences, which we might not be able to cope with.

On OneView 5.40, is there an alternate way to disable TLS v1.1 ?

I could not find any in the documentation I went through, but I have to ask.

Thanks for your support

[ChrisLynch · Accepted solution]

Yes.  This is currently controlled by REST API calls.  We provide a PowerShell Cmdlet that can get the configuration (Get-OVApplianceSecurityProtocol ) and change it (Set-OVApplianceSecurityProtocol ).

[Manu]

Hello, by disabling TLSv1.1 without going to CNSA.

We would still have available all the cyphers/keyexchange available in FIPS ?

Is there anything else that is removed/disabled when disabling TLSv1.1 using Set-OVApplianceSecurityProtocol ?

Tks

[ChrisLynch]

You can only change the TLS mode of the appliance with that Cmdlet.  If you need to also change the crypto ciphers, you need to change the cryptography mode from Legacy to FIPS or CNSA.

[FrediCocon]

Hello 

Thanks for your help

Is there any risk in changing the cryptography to FIPS mode? Is there any effect on the oneview configuration? or the change is transparent?

Thanks

[ChrisLynch]

Changing the appliance cryptography mode does have impact to the appliance and the devices and services it can connect to.  I would suggest you review the User Guide ("Cryptography mode settings" chapter)  on the various modes and potential impact.