<p>while evaluating the network security using nmap on Kubernetes server, we noticed a warning as below</p>
<p>~]# nmap xxx.xx.xx.xx -p 6443 -sVC --script=ssl*</p>
<pre><code>.
.
.
ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors: 
|       NULL
|     cipher preference: server
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack

</code></pre>
<p>With bit of research got to know that <strong>TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C</strong> cipher suite is to support 64bit block SSL/TLS Handshake and the suggested solution is to disable the cipher option in Kubernetes etcd. please help me how to do it.</p>
<p>other views on this much appreciated, please let me know what is the better way to secure the environment.</p>

Thribhuvan HRz
<p>You can use the <code>--cipher-suites</code> CLI option to etcd. See <a href="https://etcd.io/docs/v3.4/op-guide/security/" rel="nofollow noreferrer">https://etcd.io/docs/v3.4/op-guide/security/</a> for a summary of all their TLS config options. The default ciphers is based on the version of Go used to compile it.</p>
