# Weak SSL config for https://grype.anchore.io

**URL:** <https://anchorecommunity.discourse.group/t/weak-ssl-config-for-https-grype-anchore-io/576>\
**Category:** Grype\
**Created:** [October 13, 2025, 9:14am UTC](https://anchorecommunity.discourse.group/t/weak-ssl-config-for-https-grype-anchore-io/576 "2025-10-13T09:14:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TimBim](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@TimBim](https://anchorecommunity.discourse.group/u/TimBim)\
**Post date:** [October 13, 2025, 9:14am UTC](https://anchorecommunity.discourse.group/t/weak-ssl-config-for-https-grype-anchore-io/576/1 "2025-10-13T09:14:56Z")

</div>

Dear Grype team,  
We need to automatically download/mirror the grype database to an air-gapped environment from URL `grype.anchore.io/databases/v6/latest.json` as you have discontinued the hosting from `toolbox-data.anchore.io`.

One of our security constrains is that the source URL must have a “A” in the SSL labs test.  
Based on the current test results `grype.anchore.io` has a “B“ because it still supports outdated TLS1.0/1.1: [SSL Server Test: grype.anchore.io (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=grype.anchore.io)

The old hosting `toolbox-data.anchore.io` has a good “A“ in its report: [SSL Server Test: toolbox-data.anchore.io (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=toolbox-data.anchore.io)

Is there really a need to support these outdated TLS versions? Could this be fixed to TLS 1.3 only?

Our security team is currently denying the whitelisting to `grype.anchore.io`

best regards  
Tim

---

<div class="post-metadata">

**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\
**Post date:** [October 13, 2025, 1:10pm UTC](https://anchorecommunity.discourse.group/t/weak-ssl-config-for-https-grype-anchore-io/576/2 "2025-10-13T13:10:13Z")

</div>

Hi @TimBim! Thanks for letting us know. We will take a look.

---

<div class="post-metadata">

**Author:** ![wagoodman](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/wagoodman/32/13_2.png) [@wagoodman](https://anchorecommunity.discourse.group/u/wagoodman)\
**Post date:** [October 13, 2025, 2:02pm UTC](https://anchorecommunity.discourse.group/t/weak-ssl-config-for-https-grype-anchore-io/576/3 "2025-10-13T14:02:42Z")

</div>

Thanks for reporting! Initially I was confused since I couldn’t seem to reproduce the test

```auto
openssl s_client -connect grype.anchore.io:443 -servername grype.anchore.io -tls1

...
C020EEF601000000:error:0A0000BF:SSL routines:tls_setup_handshake:no protocols available:ssl/statem/statem_lib.c:155:
...
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
...

```

^ with SNI

```auto
openssl s_client -connect 104.20.39.210:443 -tls1

...
C020EEF601000000:error:0A0000BF:SSL routines:tls_setup_handshake:no protocols available:ssl/statem/statem_lib.c:155:
...
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
...

```

^ without SNI, using one of the test IPs from the ssllabs report

However, it looks like you can still force a downgrade with `-cipher 'ALL:@SECLEVEL=0'`:

```auto
openssl s_client -connect grype.anchore.io:443 -servername grype.anchore.io -tls1 -cipher 'ALL:@SECLEVEL=0'
...
New, TLSv1.0, Cipher is ECDHE-RSA-AES128-SHA
Protocol: TLSv1
Server public key is 2048 bit
Secure Renegotiation IS supported
...
SSL-Session:
    Protocol : TLSv1
    Cipher : ECDHE-RSA-AES128-SHA
...

```

Not great! So even though we had minimum TLS set to 1.2 in the CDN, the backing store service still supported 1.0 as the minimum. We bumped the minimums on the store service to 1.2 and started to see the behavior we expected (and [ssllabs has upgraded us to an A](https://www.ssllabs.com/ssltest/analyze.html?d=grype.anchore.io)).

Thanks again for reporting 🙌

---

<div class="post-metadata">

**Author:** ![TimBim](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@TimBim](https://anchorecommunity.discourse.group/u/TimBim)\
**Post date:** [October 14, 2025, 6:24am UTC](https://anchorecommunity.discourse.group/t/weak-ssl-config-for-https-grype-anchore-io/576/4 "2025-10-14T06:24:12Z")

</div>

Good morning @willmurphy and @wagoodman !!!

That’s great news!

Thank you for taking care of it so quickly!

Best regards,

Tim