UCF STIG Viewer Logo

The vCenter VAMI service must disable client initiated TLS renegotiation.


Finding ID Version Rule ID IA Controls Severity
V-259155 VCLD-80-000097 SV-259155r935369_rule Medium
All versions of the Secure Sockets Layer (SSL) and TLS protocols (up to and including TLS 1.2) are vulnerable to a man-in-the-middle attack (CVE-2009-3555) during a renegotiation. This vulnerability allows an attacker to "prefix" a chosen plaintext to the HTTP request as seen by the web server. The protocols have since been amended by RFC 5746, but the fix must be supported by both client and server to be effective. While Lighttpd and the underlying OpenSSL libraries are no longer vulnerable, steps must be taken to account for older clients that do not support RFC 5746. To this end, Lighttpd disables client-initiated renegotiation entirely by default. This configuration must be validated and maintained.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide 2023-10-29


Check Text ( C-62895r935367_chk )
At the command prompt, run the following command:

# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl\.disable-client-renegotiation"

If no line is returned, this is not a finding.

If "ssl.disable-client-renegotiation" is set to "disabled", this is a finding.

Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details:

Fix Text (F-62804r935368_fix)
Navigate to and open:


Remove any setting for "ssl.disable-client-renegotiation".

Restart the service with the following command:

# vmon-cli --restart applmgmt