Comware

In Procurve (ArubeOS) it is so easy to "correct"

https://community.arubanetworks.com/community-home/digestviewer/viewthread?MID=25863

In Comware

ssl version ssl3.0 disable
ssl version tls1.0 disable
ssl version tls1.1 disable

and 

ssl server-policy my-server-policy
ciphersuite DHE_RSA_AES_128_CBC_SHA DHE_RSA_AES_128_CBC_SHA256 DHE_RSA_AES_256_CBC_SHA DHE_RSA_AES_256_CBC_SHA256 ECDHE_RSA_AES_128_CBC_SHA256 ECDHE_RSA_AES_128_GCM_SHA256 ECDHE_RSA_AES_256_CBC_SHA384 ECDHE_RSA_AES_256_GCM_SHA384 RSA_AES_128_CBC_SHA RSA_AES_128_CBC_SHA256 RSA_AES_256_CBC_SHA RSA_AES_256_CBC_SHA256

"Ofcourse" in Comware SSL needs to be restarted with

#undo ip https ena

#ip https ena

 After that it is all correct:

PORT    STATE SERVICE443/tcp open  https| ssl-cert: Subject: commonName=HPE5900-SR1..*****.local/countryName=GB| Issuer: commonName=****-EntCA| Public Key type: rsa| Public Key bits: 2048| Signature Algorithm: sha256WithRSAEncryption| Not valid before: 2019-07-10T12:32:11| Not valid after:  2021-07-09T12:32:11| MD5:   3bb8 a0fd 2480 89c2 122f fc9c 87b6 26d5|_SHA-1: 9132 310c 4a00 40ee 6bd6 e41e 6a8f 4e3a 230f a09c| ssl-enum-ciphers:|   TLSv1.2:|     ciphers:|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A|     compressors:|       NULL|     cipher preference: client|     warnings:|       Key exchange (dh 1024) of lower strength than certificate key|_  least strength: A

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

And what is your certificate? Is it ECDHE ?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

And what is your certificate? Is it ECDHE ?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

I also tried, cause why not, switching out the policies to match that which is displayed when no ssl server policy is applied.  IE

[code]
[HP-BuildRoom-24]display ssl server-policy
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         RSA_AES_128_CBC_SHA
         RSA_AES_256_CBC_SHA
         DHE_RSA_AES_128_CBC_SHA
         DHE_RSA_AES_256_CBC_SHA
         RSA_AES_128_CBC_SHA256
         RSA_AES_256_CBC_SHA256
         DHE_RSA_AES_128_CBC_SHA256
         DHE_RSA_AES_256_CBC_SHA256
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]

However, Nmap still shows the same thing after, no ciphers being displayed at all

And what is your certificate? Is it ECDHE ?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

I get this:

<HPE5900-SR1>display ssl server-policyTotal number of SSL server policies: 1 SSL server policy: domain-ssl     PKI domain: domain     Ciphersuites:         RSA_AES_128_CBC_SHA         RSA_AES_256_CBC_SHA         DHE_RSA_AES_128_CBC_SHA         DHE_RSA_AES_256_CBC_SHA         RSA_AES_128_CBC_SHA256         RSA_AES_256_CBC_SHA256         DHE_RSA_AES_128_CBC_SHA256         DHE_RSA_AES_256_CBC_SHA256         ECDHE_RSA_AES_128_CBC_SHA256         ECDHE_RSA_AES_256_CBC_SHA384         ECDHE_RSA_AES_128_GCM_SHA256         ECDHE_RSA_AES_256_GCM_SHA384     Session cache size: 500     Client-verify: disabled

I also tried, cause why not, switching out the policies to match that which is displayed when no ssl server policy is applied.  IE

[code]
[HP-BuildRoom-24]display ssl server-policy
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         RSA_AES_128_CBC_SHA
         RSA_AES_256_CBC_SHA
         DHE_RSA_AES_128_CBC_SHA
         DHE_RSA_AES_256_CBC_SHA
         RSA_AES_128_CBC_SHA256
         RSA_AES_256_CBC_SHA256
         DHE_RSA_AES_128_CBC_SHA256
         DHE_RSA_AES_256_CBC_SHA256
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]

However, Nmap still shows the same thing after, no ciphers being displayed at all

And what is your certificate? Is it ECDHE ?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

self-signed cert?  

I get this:

<HPE5900-SR1>display ssl server-policyTotal number of SSL server policies: 1 SSL server policy: domain-ssl     PKI domain: domain     Ciphersuites:         RSA_AES_128_CBC_SHA         RSA_AES_256_CBC_SHA         DHE_RSA_AES_128_CBC_SHA         DHE_RSA_AES_256_CBC_SHA         RSA_AES_128_CBC_SHA256         RSA_AES_256_CBC_SHA256         DHE_RSA_AES_128_CBC_SHA256         DHE_RSA_AES_256_CBC_SHA256         ECDHE_RSA_AES_128_CBC_SHA256         ECDHE_RSA_AES_256_CBC_SHA384         ECDHE_RSA_AES_128_GCM_SHA256         ECDHE_RSA_AES_256_GCM_SHA384     Session cache size: 500     Client-verify: disabled

I also tried, cause why not, switching out the policies to match that which is displayed when no ssl server policy is applied.  IE

[code]
[HP-BuildRoom-24]display ssl server-policy
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         RSA_AES_128_CBC_SHA
         RSA_AES_256_CBC_SHA
         DHE_RSA_AES_128_CBC_SHA
         DHE_RSA_AES_256_CBC_SHA
         RSA_AES_128_CBC_SHA256
         RSA_AES_256_CBC_SHA256
         DHE_RSA_AES_128_CBC_SHA256
         DHE_RSA_AES_256_CBC_SHA256
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]

However, Nmap still shows the same thing after, no ciphers being displayed at all

And what is your certificate? Is it ECDHE ?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?

No, local MS AD CA issued certificate

self-signed cert?  

I get this:

<HPE5900-SR1>display ssl server-policyTotal number of SSL server policies: 1 SSL server policy: domain-ssl     PKI domain: domain     Ciphersuites:         RSA_AES_128_CBC_SHA         RSA_AES_256_CBC_SHA         DHE_RSA_AES_128_CBC_SHA         DHE_RSA_AES_256_CBC_SHA         RSA_AES_128_CBC_SHA256         RSA_AES_256_CBC_SHA256         DHE_RSA_AES_128_CBC_SHA256         DHE_RSA_AES_256_CBC_SHA256         ECDHE_RSA_AES_128_CBC_SHA256         ECDHE_RSA_AES_256_CBC_SHA384         ECDHE_RSA_AES_128_GCM_SHA256         ECDHE_RSA_AES_256_GCM_SHA384     Session cache size: 500     Client-verify: disabled

I also tried, cause why not, switching out the policies to match that which is displayed when no ssl server policy is applied.  IE

[code]
[HP-BuildRoom-24]display ssl server-policy
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         RSA_AES_128_CBC_SHA
         RSA_AES_256_CBC_SHA
         DHE_RSA_AES_128_CBC_SHA
         DHE_RSA_AES_256_CBC_SHA
         RSA_AES_128_CBC_SHA256
         RSA_AES_256_CBC_SHA256
         DHE_RSA_AES_128_CBC_SHA256
         DHE_RSA_AES_256_CBC_SHA256
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]

However, Nmap still shows the same thing after, no ciphers being displayed at all

And what is your certificate? Is it ECDHE ?

With no policy applied I get this
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds
[/code]

Then I apply the following server policy
[code]
Total number of SSL server policies: 1
 SSL server policy: examplepolicyfromhp
     PKI domain:
     Ciphersuites:
         ECDHE_RSA_AES_128_CBC_SHA256
         ECDHE_RSA_AES_256_CBC_SHA384
         ECDHE_RSA_AES_128_GCM_SHA256
         ECDHE_RSA_AES_256_GCM_SHA384
     Session cache size: 500
     Caching timeout: 3600 seconds
     Client-verify: Disabled
     Certificate chain sending: Disabled
[/code]
After applying the ssl server policy and running the nmap
[code]

Host is up (0.0010s latency).

PORT    STATE SERVICE
443/tcp open  https
MAC Address: 4C:AE:A3:C3:90:94 (Hewlett Packard Enterprise)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds
[/code]
SSL3.0, TLS1.0, and TLS1.1 are all disabled as well but enabling them doesn't seem to resolve anything.  There is no rhyme or reason to that specific cipher set.  Just happened to be the last set of ciphers that I tried.
Thanks for the response!

What what does nmap show?

nmap --script ssl-enum-ciphers -p 443 host_IP_or_DNS

@jmpk I've followed what you've listed above, however, no matter what ciphersuites I select, once I apply the server policy to HTTPS, I get a "This site can't provide a secure connection <IP> uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite." error.  I've tried multiple permutations but every one ends the same, I can't get into the web config with the SSL server-policy enabled.  Suggestions?