Envoy must use only Transport Layer Security (TLS) 1.2 for the protection of client connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256740	VCRP-70-000004	SV-256740r889158_rule		Medium

Description

Envoy can be configured to support TLS 1.0, 1.1, and 1.2. Due to intrinsic problems in TLS 1.0 and TLS 1.1, they are disabled by default. The <protocol> block in the rhttpproxy configuration is commented out by default, and this configuration forces TLS 1.2. The block may also be set to "tls1.2" in certain upgrade scenarios, but the effect is the same. Uncommenting the block and enabling older protocols is possible; therefore, TLS 1.2 restriction must be verified and maintained. Satisfies: SRG-APP-000015-WSR-000014, SRG-APP-000172-WSR-000104, SRG-APP-000439-WSR-000151, SRG-APP-000439-WSR-000152, SRG-APP-000439-WSR-000156, SRG-APP-000441-WSR-000181, SRG-APP-000442-WSR-000182

STIG	Date
VMware vSphere 7.0 vCenter Appliance RhttpProxy Security Technical Implementation Guide	2023-02-21

Details

Check Text ( C-60415r889156_chk )
At the command prompt, run the following command: # xmllint --xpath '/config/vmacore/ssl/protocols' /etc/vmware-rhttpproxy/config.xml Expected result: XPath set is empty or tls1.2 If the output does not match the expected result, this is a finding.

Fix Text (F-60358r889157_fix)
Navigate to and open: /etc/vmware-rhttpproxy/config.xml Locate the // block and configure as follows: tls1.2 Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy