PCI Compliance Failing - TLS v1.0

[Jennings Smith]

We have a 3CX self-hosted 15.5 install running on Windows Server 2016 and have run into an issue with the new "Enable PCI Compliance SSL Transport and Ciphers" setting. Even after enabling this and restarting the server, we're still failing our PCI compliance scan. The scan comes back from our IP address with the port 5061 still using TLS v1.0 ciphers. I've checked in the open ports of the Windows Server Resource Monitor and can see that port is assigned to the 3CXPhoneSystem.exe.

Is anyone else having a hard time getting PCI compliance even after enabling this setting? I've checked the Nginx config and it looks like it's including the "snippets" configurations which has the ssl protocols TLSv1.2; setting, but that doesn't appear to be restricting it at all. Our partner has recently disbanded his company, so we don't really have any way to get support on this at the moment. Any help or experience with this from others would be greatly appreciated. Thanks!

These are the ciphers still failing according to our scan:
TLSv1 : ECDHE-RSA-AES256-SHA
TLSv1 : AES256-SHA
TLSv1 : CAMELLIA256-SHA
TLSv1 : ECDHE-RSA-AES128-SHA
TLSv1 : AES128-SHA
TLSv1 : CAMELLIA128-SHA

 

[cobaltit]

Port 5061 isn't Nginx, that's SIP TLS. If you are really worried about it block it since you likely aren't using it and then it won't come up on the scan. If you are looking for a new partner feel free to PM me.