How to disable use of TLS 1.0 and weak ciphers?

[yoni.rabinovitch]

An external penetration test vendor flagged our Auth0 domain URL as having potential security vulnerabilities because it doesn’t have TLS 1.0 disabled, and because of use of what is considered to be a weak SSL cipher (TLS_RSA_WITH_3DES_EDE_CBC_SHA) with key length of less than 128 bits.
Is there any way to configure Auth0 to disable use of TLS 1.0 and weak ciphers?

[konrad.sopala]

Let me get in touch with our Security Team @yoni.rabinovitch!

[konrad.sopala]

So I managed to find out that modern TLS, which offers TLS 1.2 only and a better cipher suite, is available for cloud customers using custom domains with Auth0 managed certificates. You can open a support ticket to request to opt-in to modern config.

[yoni.rabinovitch]

@konrad.sopala

opt

Thanks very much, will do!

[konrad.sopala]

No worries! We’re here for you!

[konrad.sopala]

Hey there Folks!

Little update from here. Now you can do that yourself!

Here’s how to achieve that:

How can I disable TLS 1.0, TLS 1.1 and weak ciphers with custom domains?

Question: How can I disable TLS 1.0, TLS 1.1 and weak ciphers with custom domains? Answer This can be done now as a self-service operation using Management API v2. Use the Update a custom domain endpoint (PATCH /api/v2/custom-domains/{id}) with the following payload: { "tls_policy":"recommended" } Note how you don’t really specify protocols or individual ciphers. recommended means that Auth0 uses the industry recommendations and might update the supported protocols or ciphers from time to…