Java crypto roadmap

[Christopher Bongaarts]

On 10/16/2019 9:34 AM, Ian Young wrote:
> * TLS 1.0 and TLS 1.1 being*disabled*  in all versions of Java from Java 7 onwards, second half of 2020. This is new and will presumably affect existing deployments if they take the relevant Java update (which I have to assume a lot of people will).
>
> I don't think there are a lot of circumstances in which this would affect the IdP, as it doesn't initiate connections very often, but:
>
> * A really old SP doing attribute query might be affected.
>
> * The IdP might be affected if it was fetching metadata from an HTTPS location that was too old to support TLS 1.2. That sounds like an unlikely combination.
>
> Am I missing anything?

Presumably it would also affect outbound LDAPS connections.

Not sure if TLS is used on database connections, but that would be 
another place I'd double check.

Web services calls to Duo would also fall under this.  I think it's safe 
to assume they support 1.2 or 1.3, though.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%