TLS: downgrade and weak ciphers

October 23, 2025 · 1 min read · #crypto #tls #network

TLS negotiates version and cipher suite between client and server. An active man-in-the-middle manipulates the handshake to force the weakest option still supported.

The downgrade family

POODLE forced SSLv3 (a CBC padding oracle). FREAK/Logjam forced "export" ciphers with factorable 512-bit keys. The root is common: supporting old protocols/ciphers for compatibility leaves a weak door.

Defence

# TLS 1.2/1.3 only, no weak ciphers
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

Disable SSLv3/TLS1.0/1.1 and export ciphers. Enable TLS 1.3, which removes insecure negotiation. Use HSTS to prevent downgrade to HTTP. Test with tools like testssl.sh.

« back to home