SSL/TLS on IdP server

[Andrew Morgan]

On Wed, 10 Dec 2014, IAM David Bantz wrote:

> Attending to urgings from Joe St Sauver and other security gurus, I'd like
> to move SSL support to TLS 1.2 only and replace cipher suites SSL Labs
> labels "weak" on my IdP 2.4.0 running in Tomcat 6 container on RHEL.  When
> I made specific recommendations to our system admins, they suggest
> delegating SSL to Apache (i.e., Apache web server rather than Apache
> Tomcat).  Is that a strategy others follow?  Is it well documented?
>
> My cursory look at documentation suggests that a Connector statement in
> tomcat's ~/conf/server.xml can designate both supported SSL protocols and
> cipher suites, using
>    sslEnabledProtocols="TLSv1.2" and
>    ciphers="TLS_RSA_WITH_AES128_CBC_SHA, {etc}"
> Am I pointed in roughly the right direction, or do I need to follow my sys
> admins' urging to use Apache and configure SSL there.

We frontend our IDP with Apache, but you can make the same cipher and 
protocol changes using Tomcat.

I'm not familiar with the version of Tomcat6 in RHEL.  There are a lot of 
notes in the changelog about SSL and TLS configuration issues:

   http://tomcat.apache.org/tomcat-6.0-doc/changelog.html

You may have trouble getting a clean report from SSL Labs unless you are 
on a recent release of Tomcat 6.

 	Andy