The internal API gateway negotiates TLS_RSA_WITH_AES_128_CBC_SHA and three other CBC-mode cipher suites during the TLS handshake. These suites do not provide forward secrecy and are explicitly disallowed by the system's cryptographic baseline, which requires AEAD suites with ECDHE key exchange.
Both gateway nodes accept the weak suites on 443/TCP. The gateway is reachable from tenant workloads inside the VPC but not from the public internet, which reduces exposure without removing it.
Restrict the gateway's TLS policy to the approved AEAD suite list, reload the listener configuration, and rescan to confirm the plugin no longer fires against either node.
| Asset Identifier | Hostname | Type | Environment | Port | In Inventory |
|---|---|---|---|---|---|
| 10.42.4.20 | apigw-prod-01 | Virtual machine | Production | 443/TCP | Matched |
| 10.42.4.21 | apigw-prod-02 | Virtual machine | Production | 443/TCP | Matched |