# Payara security rating **URL:** \ **Category:** Technical Discussion\ **Created:** [December 8, 2021, 6:06pm UTC](https://forum.payara.fish/t/payara-security-rating/167 "2021-12-08T18:06:26Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![brasta78](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@brasta78](https://forum.payara.fish/u/brasta78)\ **Post date:** [December 8, 2021, 6:06pm UTC](https://forum.payara.fish/t/payara-security-rating/167/1 "2021-12-08T18:06:27Z")
Hi, Testing Payara server (default configuration) with [https://www.ssllabs.com/](https://www.ssllabs.com/ssltest/analyze.html) we have B rating because a Key exchange and Cipher strength. I’ve selected Cipher suites for http-listener-2: ```auto TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH x25519 (eq. 3072 bits RSA) FS 128 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH x25519 (eq. 3072 bits RSA) FS 256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 2048 bits FS 128 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 2048 bits FS 256 ``` and got A rating for cipher strength, but I don’t know if it is “enough” for a real life… Can anybody just tell how to get A rating not going deeply to technical details what is a Key exchange and Cipher strength and get green security rating for Payara? ---
**Author:** ![charlee\_ch](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.payara.fish/charlee_ch/32/51_2.png) [@charlee\_ch](https://forum.payara.fish/u/charlee_ch)\ **Post date:** [December 9, 2021, 2:09am UTC](https://forum.payara.fish/t/payara-security-rating/167/2 "2021-12-09T02:09:04Z")
Hi, To have the A+ from SSL Lab may be divided to four parts as the following captured picture. ![1639015166446](https://europe1.discourse-cdn.com/flex017/uploads/payara/original/1X/eb65bc57b9fe1567a7526d89ccd25d6aefc397be.jpeg) The Certificate, Protocol Support, Key Exchange and Cipher Strength. Moreover, apart from the trusted and strong Certificate itself, the `TLS 1.3` and `HTTP Strict Transport Security (HSTS)` also are the significant. The Payara also provides both already as the following link: - - [Payara Platform Supports TLS 1.3 on JDK 8](https://blog.payara.fish/payara-platform-supports-tls-1.3-on-jdk-8) - [How to Configure the HSTS Header on Payara](https://blog.payara.fish/how-to-configure-the-hsts-header-on-payara) - [SSL/TLS Options :: Payara Community Documentation](https://docs.payara.fish/community/docs/documentation/payara-server/server-configuration/http/protocols/ssl-options.html) - [TLS V1.3 Enabled](https://docs.payara.fish/community/docs/documentation/payara-server/server-configuration/http/protocols/ssl-options.html#configuration-ssl-tls13) - [HSTS Enabled](https://docs.payara.fish/community/docs/documentation/payara-server/server-configuration/http/protocols/ssl-options.html#configuration-hsts-enabled) ---
**Author:** ![brasta78](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@brasta78](https://forum.payara.fish/u/brasta78)\ **Post date:** [December 13, 2021, 2:53pm UTC](https://forum.payara.fish/t/payara-security-rating/167/3 "2021-12-13T14:53:43Z")
Of course I have SSL certificate, HSTS is enabled, I’ve enabled TLS 1.3, but my server still have B rating because Key Exchange B grade… If I select cipher suites mentioned in my first post, then TLS 1.3 shows not enabled, when I use all cipher suites provided in Payara, then TLS 1.3 is enabled, but I have B grade because: `This server supports weak Diffie-Hellman (DH) key exchange parameters.` `This server does not support Forward Secrecy with the reference browsers.` ![image](https://europe1.discourse-cdn.com/flex017/uploads/payara/original/1X/65381baea9a1d640c877d0685523efeae1eff707.png) So question remains the same - how to have A rating for Payara server? ---
**Author:** ![charlee\_ch](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.payara.fish/charlee_ch/32/51_2.png) [@charlee\_ch](https://forum.payara.fish/u/charlee_ch)\ **Post date:** [December 13, 2021, 5:23pm UTC](https://forum.payara.fish/t/payara-security-rating/167/4 "2021-12-13T17:23:03Z")
To config the cipher suites can be done as the following steps: - - Firstly go to Admin Console → server-config → HTTP Service → Http Listener → http-listener-2 - At the http-listener-2 screen, click at SSL tab - Then scroll down to the Cipher Suites section and choose only the strong the cipher suite.