SSL/TLS on IdP server

[Cantor, Scott]

On 12/10/14, 11:11 PM, "IAM David Bantz" <dabantz at alaska.edu> wrote:



>Attending to urgings from Joe St Sauver and other security gurus, I'd 
>like to move SSL support to TLS 1.2 only and replace cipher suites SSL 
>Labs labels "weak" on my IdP 2.4.0 running in Tomcat 6 container on RHEL. 
> When I made specific recommendations to our system admins, they suggest 
>delegating SSL to Apache (i.e., Apache web server rather than Apache 
>Tomcat).  Is that a strategy others follow?  Is it well documented?

It's documented, not by us much anymore. AJP connectors come with Apache.

If you do it for the back-channel that's a different matter, you have to 
also configure Apache to avoid validating client certs, and you have to 
live with its bugs and foibles, such as not accepting expired certs (which 
our Tomcat and Jetty plugins will accept).

>My cursory look at documentation suggests that a Connector statement in 
>tomcat's ~/conf/server.xml can designate both supported SSL protocols and 
>cipher suites, using 
>    sslEnabledProtocols="TLSv1.2" and     
>    ciphers="TLS_RSA_WITH_AES128_CBC_SHA, {etc}"
>Am I pointed in roughly the right direction, or do I need to follow my 
>sys admins' urging to use Apache and configure SSL there.

There are lot of settings accumulated over time that overlap and seem to 
interact in weird ways, but assuming one figures out what they use or asks 
them, it works fine.

If you were really looking at changing the architecture, my advice would 
be Jetty > Apache + Tomcat.

-- Scott