SSL 证书

有些漏洞是可以通过命令规避的例如：

CVE-2011-1473:

关闭SSL重协商

[125AF]ssl renegotiation disable

CVE-2015-2808：

建议配置规避措施，使用SSL命令关掉RC4算法

[H3C]ssl server-policy fxm

[H3C-ssl-server-policy-fxm]ci

[H3C-ssl-server-policy-fxm]ciphersuite ?  //选个非RC4的算法

  dhe_rsa_aes_128_cbc_sha  Cipher suite that uses DHE RSA, 128-bit AES_CBC, and

                           SHA

  dhe_rsa_aes_256_cbc_sha  Cipher suite that uses DHE RSA, 256-bit AES_CBC, and

                           SHA

  exp_rsa_des_cbc_sha      Export cipher suite that uses RSA, DES_CBC, and SHA

  exp_rsa_rc2_md5          Export cipher suite that uses RSA, RC2, and MD5

  exp_rsa_rc4_md5          Export cipher suite that uses RSA, RC4, and MD5

  rsa_3des_ede_cbc_sha     Cipher suite that uses RSA, 3DES_EDE_CBC, and SHA

  rsa_aes_128_cbc_sha      Cipher suite that uses RSA, 128-bit AES_CBC, and SHA

  rsa_aes_256_cbc_sha      Cipher suite that uses RSA, 256-bit AES_CBC, and SHA

  rsa_des_cbc_sha          Cipher suite that uses RSA, DES_CBC, and SHA

  rsa_rc4_128_md5          Cipher suite that uses RSA, 128-bit RC4, and MD5

  rsa_rc4_128_sha          Cipher suite that uses RSA, 128-bit RC4, and SHA

之后重启https服务

undo ip https enable

ip https enable

CVE-2014-3566：

建议关闭ssl3.0

[125AF]ssl version ssl3.0 disable