SSL/TLS on IdP server

[Peter Schober]

* IAM David Bantz <dabantz at alaska.edu> [2014-12-11 00:12]:
> Attending to urgings from Joe St Sauver and other security gurus, I'd like
> to move SSL support to TLS 1.2 only and replace cipher suites SSL Labs
> labels "weak" on my IdP 2.4.0 running in Tomcat 6 container on RHEL.  When
> I made specific recommendations to our system admins, they suggest
> delegating SSL to Apache (i.e., Apache web server rather than Apache
> Tomcat).  Is that a strategy others follow?  Is it well documented?

If you're using httpd as web server and are passing everything to
Tomcat via AJP, then yes, then httpd is where you configure TLS, as
per httpd's documenation (or following https://bettercrypto.org/ for
example).
If OTOH you're using Tomcat as web server (and not relying on httpd to
terminate TLS) that is where you make any changes for TLS.
-peter