> SSL certificate deemed insecure - Apparently they do not pass SHA-1, they have no issue with it being self-signed, only that they want something higher than SHA1 which is my only option.
When you request a new certificate, it typically can be controlled by the enrollment-process if you get a SHA-1 or SHA256 certificate. Nowadays all CAs out there should be able to issue SHA256.
> Public Key too small, - SSL cerificates with public keys of less than 2048 bits are more susceptible for man in the middle attacks. - Again, I cannot get 2048 or higher with self-signed.
Also with self-signed certificates you can use 2048 Bit, but if generated on the ASA, they will use SHA-1. Be aware that the ASA doesn't allow certificates with more then 2048 Bit for SSL-VPNs
> SSL3 - This service supports SSLv3 Protocol has known cryptographic weakness and no longer meets definition of strong cryptography.
Can already be disabled with your ASA version. You could use the following code:
ssl server-version tlsv1-only
ssl encryption dhe-aes256-sha1 dhe-aes128-sha1 aes256-sha1 aes128-sha1
>TLS1 - This service supports the use of TLSv1.0 protocol, the TLSv1.0 protocol has known cryptographic weaknesses that can lead to the compromise of sensitive data within an encrypted session. TLSv10 no longer meets the definition of strong cryptography. The 5512 only supports SSLv3 or TLSv1.0
As already mentioned, you need to upgrade to 9.3 to get support for TLS 1.2.
With ASA v9.3+ you can use the following config:
ssl cipher default custom "DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA"
ssl cipher tlsv1 custom "DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA"
ssl cipher dtlsv1 custom "DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA"
ssl dh-group group14
Because of some other shortcomings of the ASA, you don't get an "A+" in ssllabs.com ratings, but my ASAs (at least teh ones capable of running v9.3) all have an "A-"
