Verify TLS/SSL cipher suites

This task helps you resolve cipher suite incompatibility errors that occur when saving a decryption rule that has cipher suite conditions. The error indicates that one or more of the cipher suites you chose for the decryption rule condition are incompatible with the certificate used in the decryption rule.

This topic discusses actions you must take if you see the following error when saving a decryption rule that has cipher suite conditions:

Traffic cannot match this rule; none of your selected cipher suites contain a signature 
algorithm that matches the resigning CA's signature algorithm

Before you begin

To resolve the issue, you must have access to the certificate you're using.

Note

The tasks in this topic assume knowledge of how TLS/SSL encryption works.

Follow these steps to verify TLS/SSL cipher suites:

Procedure

Step 1

When you attempt to save a decryption rule rule with either Decrypt - Resign or Decrypt - Known Key with specified cipher suites, the following error is displayed:

Example:

Traffic cannot match this rule; none of your selected cipher suites contain a 
signature algorithm that the resigning CA's signature algorithm

Step 2

Locate the certificate you're using to decrypt traffic and, if necessary, copy the certificate to a system that can run openssl commands.

Step 3

Run the following command to display the signature algorithm used by the certificate:

Example:

openssl x509 -in CertificateName -text -noout

The first few lines of output are displayed similar to the following:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4105 (0x1009)
    Signature Algorithm: ecdsa-with-SHA256

Step 4

The Signature algorithm tells you the following:

  • The cryptographic function used (in the preceding example, ECDSA means Elliptic Curve Digital Signature Algorithm).

  • The hash function used to create a digest of the encrypted message (in the preceding example, SHA256 ).

Step 5

Search a resource such as OpenSSL at University of Utah for cipher suites that match those values. The cipher suite must be in RFC format.

You can also search a variety of other sites, such as Server Side TLS at the Mozilla wiki or Appendix C of RFC 5246. Cipher Suites in TLS/SSL (Schannel SSP) in Microsoft documentation has a detailed explanation of cipher suites.

Step 6

If necessary, translate the OpenSSL name to an RFC name that the Firepower Management System uses.

See the RFC mapping list on the on the https://testssl.sh site.

Step 7

The previous example, ECDSA-with-SHA256 , can be found in the Modern Compatibility List on the Mozilla wiki.

Choose only cipher suites that have ECDSA and SHA-256 in the name. These cipher suites follow:

ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256

Find the corresponding RFC cipher suite on RFC mapping list. These cipher suites follow:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Step 8

Add the preceding cipher suites to your decryption rule.