CME-408
System-wide TLS/Crypto Policy Enforcement
Description
Enforce minimum TLS version and cipher suite requirements system-wide via OS-level cryptographic policy. RHEL's update-crypto-policies sets a baseline (DEFAULT, FUTURE, FIPS) that applies to all TLS-using applications linked against system crypto libraries (OpenSSL, GnuTLS, NSS), preventing applications from accepting weak ciphers, expired certificates, or outdated TLS versions regardless of individual application configuration. Windows equivalent is SChannel registry configuration or Group Policy cipher suite ordering. Eliminates an entire class of TLS misconfiguration vulnerabilities by moving the trust decision from each application to the OS layer.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | MitM requires bypassing system-enforced minimum TLS version and cipher suite restrictions; downgrade attacks to weak protocols (SSLv3, TLS 1.0) or export ciphers are blocked at the OS library layer before reaching the application |
| Confidentiality (C) | H → L | Traffic cannot be decrypted via weak cipher downgrade or protocol rollback; system policy enforces strong cipher suites across all applications |
CWE Relationships
Verification
Verify system-wide crypto policy enforces modern TLS versions and strong cipher suites
$ update-crypto-policies --show
# Expected: DEFAULT, FUTURE, or FIPS (not LEGACY)
# Expected: DEFAULT, FUTURE, or FIPS (not LEGACY)
Platform: rhel
$ openssl s_client -connect localhost:443 -tls1 </dev/null 2>&1 | grep -i 'protocol\|error'
# Expected: Connection refused or protocol error — TLS 1.0 rejected by system policy
# Expected: Connection refused or protocol error — TLS 1.0 rejected by system policy
Platform: linux
$ update-crypto-policies --check
# Expected: The configured policy matches the generated policy
# Expected: The configured policy matches the generated policy
Platform: rhel
$ Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Enabled
# Expected: 0 — TLS 1.0 disabled on server side
# Expected: 0 — TLS 1.0 disabled on server side
Platform: windows
$ Get-TlsCipherSuite | Where-Object {$_.Name -match 'RC4|DES|NULL|EXPORT'} | Measure-Object | Select-Object -ExpandProperty Count
# Expected: 0 — no weak cipher suites enabled
# Expected: 0 — no weak cipher suites enabled
Platform: windows