Trace: • cipher

Change Cipher on ESXi

For port 443 (HTTPS) on ESXi

Connect to the ESXi host through SSH.
Take a backup of /etc/vmware/rhttpproxy/config.xml file.
Open the /etc/vmware/rhttpproxy/config.xml file in a text editor.
Find a line containing <cipherList>. If it doesn't exit, the user can create it within the XML structure:
```
<config>
  <vmacore>
     <ssl>
       <cipherList>...</cipherList>
     </ssl>
  </vmacore>
</config>
```

Replace with this line:

<cipherList>!aNULL:ECDHE+AESGCM:ECDHE+AES</cipherList>

For changes to take effect, restart the rhttpproxy service using this command:
```
/etc/init.d/rhttpproxy restart
```

Maybe if needed delete the

:ECDHE+AES

in the cipherList section too.

For port 5989 (CIM) on ESXi

Connect to the ESXi host through SSH
Navigate to /etc/sfcb folder
Take a backup of the sfcb.cfg file
Open the sfcb.cfg file in a text editor.
Add the below line:
```
sslCipherList: ECDHE+AESGCM:ECDHE+AES
```
Restart the CIM service by running this command:
```
/etc/init.d/sfcbd-watchdog restart
```

Websites & Informations

Authors:

Jochen Schnürle