> Source: [sk100584](https://support.checkpoint.com/results/sk/sk100584)

# sk100584 - Cipher strength for Client Authentication feature is under 128-bit and there is no way to control which SSL version to use

| Property | Value |
|----------|-------|
| Solution ID | sk100584 |
| Date Created | 2014-05-11 |
| Last Modified | 2021-10-20 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- Cipher strength for "Client Authentication" feature is under 128-bit and there is no way to control which SSL version to use.

## Solution

Follow these steps on Security Gateway / each cluster member to disable the unwanted SSL versions using the relevant environment variables - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`":

* Show / Hide instructions for R77.30 and above  

  **Note:** In cluster environment, this procedure must be performed on all members of the cluster.

  **Three** new environment variables were added to disable the unwanted SSL versions - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`".
  1. Disable the unwanted SSL versions using the relevant environment variables - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`":

     1. Backup the current `$CPDIR/tmp/.CPprofile.sh` script:

        **`[Expert@HostName]# cp $CPDIR/tmp/.CPprofile.sh $CPDIR/tmp/.CPprofile.sh_ORIGINAL`**   

     2. Edit the current `$CPDIR/tmp/.CPprofile.sh` script:

        **`[Expert@HostName]# vi $CPDIR/tmp/.CPprofile.sh`**   

     3. Add the relevant variables under the '`_cpprof_add INFODIR "/opt/CPinfo-10" -1 0 ; export INFODIR ;`' line:

        * To disable **TLSv1**, add the following line:

          **`export ASSL_NO_TLS=1;`**   

        * To disable **SSLv2**, add the following line:

          **`export ASSL_NO_SSLV2=1;`**   

        * To disable **SSLv3**, add the following line:

          **`export ASSL_NO_SSLV3=1;`**

     **Clarifications:**
     * **Never** define all three environment variables!  

     * You can add any **two** variables.  
       For example, to disable TLSv1 and SSLv2, add:  
       `export ASSL_NO_TLS=1;`  
       `export ASSL_NO_SSLV2=1;`  

     * On R75.10 and above, SSLv2 is used only for '`CLIENTHELLO`'.  
       You can disable SSLv2 with one other protocol, but you cannot disable TSLv1 and SSLv3 at the same time (because SSLv2 is used for '`CLIENTHELLO`' only).

     <br />

     <br />

  2. Reboot the machine.   

  3. Verify that the relevant environment variables were set:

     **`[Expert@HostName]# set | grep ASSL_NO`**

  <br />

  <br />

* Show / Hide instructions for R77.10 and R77.20  

  **Note:** In cluster environment, this procedure must be performed on all members of the cluster.

  **Three** new environment variables were added to disable the unwanted SSL versions - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`".
  1. Disable the unwanted SSL versions using the relevant environment variables - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`":

     1. Backup the current `$CPDIR/tmp/.CPprofile.sh` script:

        **`[Expert@HostName]# cp $CPDIR/tmp/.CPprofile.sh $CPDIR/tmp/.CPprofile.sh_ORIGINAL`**   

     2. Edit the current `$CPDIR/tmp/.CPprofile.sh` script:

        **`[Expert@HostName]# vi $CPDIR/tmp/.CPprofile.sh`**   

     3. Add the relevant variables under the '`INFODIR=/opt/CPinfo-10 ; export INFODIR`' line:

        * To disable **TLSv1**, add the following line:

          **`export ASSL_NO_TLS`**   

        * To disable **SSLv2**, add the following line:

          **`export ASSL_NO_SSLV2`**   

        * To disable **SSLv3**, add the following line:

          **`export ASSL_NO_SSLV3`**

     **Clarifications:**
     * **Never** define all three environment variables!  

     * You can add any **two** variables.  
       For example, to disable TLSv1 and SSLv2, add:  
       `export ASSL_NO_TLS`  
       `export ASSL_NO_SSLV2`  

     * On R75.10 and above, SSLv2 is used only for '`CLIENTHELLO`'.  
       You can disable SSLv2 with one other protocol, but you cannot disable TSLv1 and SSLv3 at the same time (because SSLv2 is used for '`CLIENTHELLO`' only).

     <br />

     <br />

  2. Reboot the machine.   

  3. Verify that the relevant environment variables were set:

     **`[Expert@HostName]# set | grep ASSL_NO`**

  <br />

  <br />

* Show / Hide instructions for R77 and lower  

  [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
  A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
  For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management and Security Gateways involved in the case.

  This hotfix adds **three** new environment variables to disable the unwanted SSL versions - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`".

  **Hotfix installation instructions:**

  **Note:** In cluster environment, this procedure must be performed on all members of the cluster.
  1. Hotfix has to be installed on **Security Gateway / each cluster member** .   

  2. Transfer the hotfix package to the machine (into some directory, e.g., `/some_path_to_fix/`).   

  3. Unpack the hotfix package:

     **`[Expert@HostName]# cd /some_path_to_fix/`**   
     **`[Expert@HostName]# tar zxvf fw1_wrapper_`*HOTFIX_NAME*`.tgz`**   

  4. Install the hotfix:

     **`[Expert@HostName]# ./fw1_wrapper_`*HOTFIX_NAME***
     Note: The script will stop all of Check Point services (`cpstop`) - read the output on the screen.   

  5. Do NOT reboot the machine yet.   

  6. Disable the unwanted SSL versions using the new environment variables - "`ASSL_NO_TLS`", "`ASSL_NO_SSLV2`", "`ASSL_NO_SSLV3`":

     1. Backup the current `$CPDIR/tmp/.CPprofile.sh` script:

        **`[Expert@HostName]# cp $CPDIR/tmp/.CPprofile.sh $CPDIR/tmp/.CPprofile.sh_ORIGINAL`**   

     2. Edit the current `$CPDIR/tmp/.CPprofile.sh` script:

        **`[Expert@HostName]# vi $CPDIR/tmp/.CPprofile.sh`**   

     3. Add the relevant variables under the '`INFODIR=/opt/CPinfo-10 ; export INFODIR`' line:

        * To disable **TLSv1**, add the following line:

          **`export ASSL_NO_TLS`**   

        * To disable **SSLv2**, add the following line:

          **`export ASSL_NO_SSLV2`**   

        * To disable **SSLv3**, add the following line:

          **`export ASSL_NO_SSLV3`**

     **Clarifications:**
     * **Never** define all three environment variables!  

     * You can add any **two** variables.  
       For example, to disable TLSv1 and SSLv2, add:  
       `export ASSL_NO_TLS`  
       `export ASSL_NO_SSLV2`  

     * On R75.10 and above, SSLv2 is used only for '`CLIENTHELLO`'.  
       You can disable SSLv2 with one other protocol, but you cannot disable TSLv1 and SSLv3 at the same time (because SSLv2 is used for '`CLIENTHELLO`' only).

     <br />

     <br />

  7. Reboot the machine.   

  8. Verify that the relevant environment variables were set:

     **`[Expert@HostName]# set | grep ASSL_NO`**

*** ** * ** ***

**Cross References**   

In addition also view **sk126613** Cipher configuration tool for Security Gateways [https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\&solutionid=sk126613\&partition=Advanced\&product=Quantum](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk126613&partition=Advanced&product=Quantum "Cipher configuration tool for Security Gateways")

For more information about Client Authentication, refer to *Firewall Administration Guide* ([R71](http://supportcontent.checkpoint.com/documentation_download?id=10309), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11660), [R75.20](http://supportcontent.checkpoint.com/documentation_download?id=12267), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13088), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16261), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22913), [R77](http://supportcontent.checkpoint.com/documentation_download?id=24836)) - Legacy Authentication - Authentication Methods - Client Authentication.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content