MEDIUM OCP (Platform) M11: Ingress TLS Ciphers P3

PASS (vanilla RHCOS 9.8+) Scanned: 2026-08-12 Synced: 2026-06-30

OCP 5.0 default IngressController TLS profile already meets CIS cipher suite requirements. No custom tlsSecurityProfile needed.

No remediation needed on OCP 5.0+. The default IngressController TLS profile in OCP 5.0 already meets CIS cipher suite requirements. Older OCP versions may require a custom tlsSecurityProfile configuration.

Overview

This remediation configures the OpenShift Ingress Controller with a custom TLS security profile that specifies approved cipher suites.

Settings

Setting	Description
`tlsSecurityProfile`	Custom TLS profile with specific cipher suites

Implementation

Modify the IngressController custom resource:

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
  name: default
  namespace: openshift-ingress-operator
spec:
  tlsSecurityProfile:
    type: Custom
    custom:
      ciphers:
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
        - ECDHE-ECDSA-AES128-GCM-SHA256
        - ECDHE-RSA-AES128-GCM-SHA256
        - ECDHE-ECDSA-AES256-GCM-SHA384
        - ECDHE-RSA-AES256-GCM-SHA384
      minTLSVersion: VersionTLS12

Compliance Checks Remediated

Check	Profile	Docs
`ocp4-cis-ingress-controller-tls-cipher-suites`	CIS	📖

Source Remediation Files

medium/ocp4-cis-ingress-controller-tls-cipher-suites.yaml

Verification

Check current TLS profile:

oc get ingresscontroller default -n openshift-ingress-operator -o jsonpath='{.spec.tlsSecurityProfile}'

Security Impact

Controlling TLS cipher suites:

Prevents use of weak ciphers
Ensures forward secrecy with ECDHE
Blocks deprecated protocols (SSLv3, TLS 1.0, TLS 1.1)
Meets PCI-DSS and other compliance requirements

← M10 All Groups M12 →