Issue

Use this article to troubleshoot and mitigate an RSA key exchange vulnerability reported for ZSphere HTTPS port 443.

Symptoms

• A security scan reports that HTTPS on port 443 supports RSA key exchange.
• The target environment requires non-compliant cipher suite entries to be disabled.

Environment

• Product: ZVF
• Version: 4.x
• Component: ZSphere
• Affected object: HTTPS/security hardening
• Scenario: Security and certificate issues. Confirm the current version, deployment topology, storage type, and operation timeline.

Possible causes

• The default UI nginx SSL cipher configuration retains broadly compatible suites.
• Security baseline requirements differ from the product default configuration.
• The change can affect compatibility with older browsers or clients.

Resolution

Perform the following checks in sequence, and record the affected objects, occurrence time, complete error messages, and current state.

1. Confirm the scan finding, target port, access domain name, and current nginx SSL configuration.
2. Before modification, back up the configuration files related to /usr/local/zstack/zstack-ui.
3. Adjust the cipher suite entries according to the security baseline, then restart the UI service.
4. Retest with a scanning tool and verify that mainstream browsers, API clients, and migration tools can connect normally.

Remediation

1. Adjust the TLS protocol and cipher suite configuration of the UI service according to the current security baseline.
2. After restarting the UI service, retest with a security scanning tool and actual clients.

Verification

• The scan result no longer reports the targeted RSA key exchange vulnerability.
• Browsers, API clients, and migration tools can still connect through the expected address.