tweaking security of IdP deployment

[IAM David Bantz]

My IdP is running in tomcat 6.0.16-0 [updated SSL libraries mod_ssl.x86_64
1:2.2.3-91.el5,  openssl.i686  0.9.8e-31.el5_11, openssl.x86_64
 0.9.8e-31.el5_11 and java-sun.x86_64 1.6.0.45-1jpp.1.el5_9 ].

I've tried to set the ssl protocol to use TLS 1.2 and not SSL 3 by editing
tomcat's ~/conf/server.xml using

    <Connector port="8444"
        protocol="HTTP/1.1"
        SSLEnabled="true"
        maxThreads="150"
        scheme="https"
        secure="true"
        clientAuth="false"
        sslProtocol="TLS"
        sslEnabledProtocols="TLSv1.1,TLSv1.2"
        ciphers="TLS_RSA_WITH_AES_128_CBC_SHA..."
       ...

Removing older ciphers this way is effective (they don't show up in SSL
Labs test), but SSL Labs test still indicates support for SSL 3 and not TLS
1.2 (nor 1.1 for that matter).

While not strictly a Shibboleth issue, there must be many of you running a
similar deployment in tomcat who have addressed this issue.  Help!

Thanks,

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141212/e51706e5/attachment.html