How to set new Option "DisableWeakCyphers" with REST Error iLo5

[Marcel_D]

Hi,

I'm trying to Enable the DisableWeakCyphers-Option with a REST Request, but getting an Error on Execution.

        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        $bodycred = @{
            "UserName"= $ilocred.UserName
            "Password"=$ilocred.GetNetworkCredential().Password
        } | ConvertTo-Json
  
        $session = Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Sessions" -Method Post -Body $bodycred -ContentType "application/json" -UseBasicParsing -ErrorAction Stop 
        $AuthHeaders = @{ "X-Auth-Token" = $Session.Headers.'X-Auth-Token' }
        $body =  '{
                        "DisableWeakCiphers":"True",
                        "TLSVersion": {
                            "TLS1_0":"Disabled",
                            "TLS1_1":"Disabled"
                        }
                    }' 

        Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Managers/1/SecurityService/" -Method Patch -Body $body -Headers $AuthHeaders -ContentType "application/json" 

Invoke-WebRequest : The remote server returned an error: (400) Bad Request.

It works, with only setting the TLS-Versions. Am I missing something or is this not possible with REST, yet?

  iLo Firmware Version 3.01 Jan 23 2024

[Kashyap02]

Hi Marcel,

Good day!

We've discovered that TLS 1.1 and TLS 1.2 can be disabled via REST API. Please try the script below with the IP and credentials of your iLO server.

If it doesn't work, please log a new case with HPE, providing the specific server details. Our team will assist you in resolving the issue.

# Set TLS version [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 # Create session $bodycred = @{ "UserName" = $ilocred.UserName "Password" = $ilocred.GetNetworkCredential().Password } | ConvertTo-Json $session = Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Sessions" -Method Post -Body $bodycred -ContentType "application/json" -UseBasicParsing -ErrorAction Stop $AuthHeaders = @{ "X-Auth-Token" = $Session.Headers.'X-Auth-Token' } # Set options $optionsBody = @{ "DisableWeakCiphers" = $true "TLSVersion" = @{ "TLS1_0" = "Disabled" "TLS1_1" = "Disabled" } } | ConvertTo-Json # Patch request $response = Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Managers/1/SecurityService/" -Method Patch -Body $optionsBody -Headers $AuthHeaders -ContentType "application/json" if ($response.StatusCode -eq 200) { Write-Host "Options set successfully." } else { Write-Host "Error: $($response.StatusCode) - $($response.StatusDescription)" Write-Host "Response content: $($response.Content)" }

[Marcel_D · Accepted solution]

That didn't work either, but I#ve found the solution.

By setting the DisableWeakCiphers to true, the TLS-Versions are automatically disabled. So you don't have to do this separately and I think the REST-Body has a Problem with that. So this would be the right code: 

        $bodycred = @{
            "UserName"= $ilocred.UserName
            "Password"=$ilocred.GetNetworkCredential().Password
        } | ConvertTo-Json
  
        $session = Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Sessions" -Method Post -Body $bodycred -ContentType "application/json" -UseBasicParsing -ErrorAction Stop 
        $AuthHeaders = @{ "X-Auth-Token" = $Session.Headers.'X-Auth-Token' }
        $body = @{
                               "DisableWeakCiphers" = $true                                 
                             } | ConvertTo-Json

        Invoke-WebRequest -Uri "https://$iloboard/redfish/v1/Managers/1/SecurityService/" -Method Patch -Body $body -Headers $AuthHeaders -ContentType "application/json" 

[Rakesh0404]

Yes, as per the script, the disableweakciphers: true , does set the TLS version to disable state.
Thank you for the update, any further queries on the same.