Blacklist Ciphersuites?

Traefik Traefik v2 (latest)
1

I know we can specify cipher suites like this but is there a way to blacklist certain ciphers as well?

tls:
  options:
    default:
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
2

I don't think that's possible, nor should it be necessary. A whitelist is the safer way. The list of safe ciphers is shorter than the blacklist would be anyway.

Instead enable the recommended setting [preferServerCipherSuites](https://doc.traefik.io/traefik/https/tls/#prefer-server-cipher-suites) and list the suites you want to allow. Due to preferServerCipherSuites the client won't be allowed to choose any other than you listed.

You can use Mozilla's config generator to create the list of recommended ciphers. See Mozilla SSL Configuration Generator

1 Like