CME-408

System-wide TLS/Crypto Policy Enforcement

Description

Enforce minimum TLS version and cipher suite requirements system-wide via OS-level cryptographic policy. RHEL's update-crypto-policies sets a baseline (DEFAULT, FUTURE, FIPS) that applies to all TLS-using applications linked against system crypto libraries (OpenSSL, GnuTLS, NSS), preventing applications from accepting weak ciphers, expired certificates, or outdated TLS versions regardless of individual application configuration. Windows equivalent is SChannel registry configuration or Group Policy cipher suite ordering. Eliminates an entire class of TLS misconfiguration vulnerabilities by moving the trust decision from each application to the OS layer.

CVSS Vector Impacts

Metric Transition Rationale
Attack Complexity (AC) L H MitM requires bypassing system-enforced minimum TLS version and cipher suite restrictions; downgrade attacks to weak protocols (SSLv3, TLS 1.0) or export ciphers are blocked at the OS library layer before reaching the application
Confidentiality (C) H L Traffic cannot be decrypted via weak cipher downgrade or protocol rollback; system policy enforces strong cipher suites across all applications

CWE Relationships

Verification

Verify system-wide crypto policy enforces modern TLS versions and strong cipher suites

$ update-crypto-policies --show
# Expected: DEFAULT, FUTURE, or FIPS (not LEGACY)
Platform: rhel
$ openssl s_client -connect localhost:443 -tls1 </dev/null 2>&1 | grep -i 'protocol\|error'
# Expected: Connection refused or protocol error — TLS 1.0 rejected by system policy
Platform: linux
$ update-crypto-policies --check
# Expected: The configured policy matches the generated policy
Platform: rhel
$ Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Enabled
# Expected: 0 — TLS 1.0 disabled on server side
Platform: windows
$ Get-TlsCipherSuite | Where-Object {$_.Name -match 'RC4|DES|NULL|EXPORT'} | Measure-Object | Select-Object -ExpandProperty Count
# Expected: 0 — no weak cipher suites enabled
Platform: windows
← CME-407: Data-at-Rest Encryption (LUKS/dm-crypt / BitLocker) CME-501: Read-Only Root Filesystem →