Zabbix 4.0.3: How to disable weak ciphers

[vigneshn]

We are using Zabbix 4.0.3 in RHEL 7. Our openssl version is 1.0.2k. We do not use any cert/psk and I used the default Zabbix server package to install Zabbix server.

When Zabbix server is started, it is using insecure cipher suite TLS 1.2: TLS_PSK_WITH_AES_128_CBC_SHA. How do I disable it?

Thanks.

[DmitryL]

https://www.zabbix.com/documentation/3.0/manual/encryption#ciphersuites

[Kate357]

I'm sure this will work.
Disabling SSL 2.0, you can disable some weak ciphers by editing the registry in the same way. To speed up the process, you can paste the following in to a text file and name it disableWeakCiphers.reg, then double-click it.
Great day ahead. see you soon.

[andris]

.... Our openssl version is 1.0.2k. We do not use any cert/psk ....

When Zabbix server is started, it is using insecure cipher suite TLS 1.2: TLS_PSK_WITH_AES_128_CBC_SHA. How do I disable it?

If you are not using "any cert/psk" then outgoing connections will never use TLS_PSK_WITH_AES_128_CBC_SHA. Incoming connections using it will be closed soon after arrival because server has no PSKs for decrypting.