SSL/TLS on IdP server

[IAM David Bantz]

Attending to urgings from Joe St Sauver and other security gurus, I'd like
to move SSL support to TLS 1.2 only and replace cipher suites SSL Labs
labels "weak" on my IdP 2.4.0 running in Tomcat 6 container on RHEL.  When
I made specific recommendations to our system admins, they suggest
delegating SSL to Apache (i.e., Apache web server rather than Apache
Tomcat).  Is that a strategy others follow?  Is it well documented?

My cursory look at documentation suggests that a Connector statement in
tomcat's ~/conf/server.xml can designate both supported SSL protocols and
cipher suites, using
    sslEnabledProtocols="TLSv1.2" and
    ciphers="TLS_RSA_WITH_AES128_CBC_SHA, {etc}"
Am I pointed in roughly the right direction, or do I need to follow my sys
admins' urging to use Apache and configure SSL there.

David Bantz
UAlaska IAIM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141210/786ba141/attachment.html