DocumentationExperience Cloud KCS

Security scan failures due to weak TLS/SSL configuration

Last update: June 27, 2026

Servers fail security validation when weak ciphers, outdated TLS versions, or unsecured HTTP endpoints remain active. Improper TLS configuration exposes endpoints to vulnerabilities such as cleartext authentication and missing forward secrecy.

Description description

Environment

  • AEM Forms
  • AEM On-Premise deployments
  • Adobe Experience Manager as a Cloud Service (AEMaaCS)

Issue/Symptoms

  • Security scans flag weak ciphers such as TLS_RSA_WITH_3DES_EDE_CBC_SHA.
  • Admin UI becomes inaccessible after cipher restrictions.
  • HTTP ports remain exposed and accept cleartext authentication.
  • Reports show missing forward secrecy or presence of RC4/3DES ciphers.
  • Outdated TLS versions such as TLS 1.0 or 1.1 remain enabled.

Cause

Incomplete or inconsistent TLS configuration across operating system, application server, and dispatcher layers leads to weak ciphers, unsupported protocol versions, or active HTTP listeners that expose unsecured endpoints.

Resolution resolution

To resolve this issue, follow these steps:

  1. Identify the deployment type to determine the correct hardening approach.
  2. Disable weak ciphers at the operating system level.
  3. Update HTTPS listeners to enable only TLS 1.2 or TLS 1.3.
  4. Disable or redirect all HTTP ports to HTTPS.
  5. Remove or disable HTTP listeners in the application server configuration.
  6. Restrict TLS versions to enforce TLS 1.2 or higher.
  7. Enable HTTPS for all authentication endpoints.
  8. Apply cipher suite restrictions in dispatcher configurations where applicable.
recommendation-more-help
experience-cloud-kcs-help-kbarticles