tweaking security of IdP deployment

[Christopher Bongaarts]

On 12/12/2014 2:32 PM, IAM David Bantz wrote:
> My IdP is running in tomcat 6.0.16-0 [updated SSL libraries 
> mod_ssl.x86_64 1:2.2.3-91.el5,  openssl.i686 
>  0.9.8e-31.el5_11, openssl.x86_64  0.9.8e-31.el5_11 and 
> java-sun.x86_64 1.6.0.45-1jpp.1.el5_9 ].
>
> I've tried to set the ssl protocol to use TLS 1.2 and not SSL 3 by 
> editing tomcat's ~/conf/server.xml using
> [...]
>         sslEnabledProtocols="TLSv1.1,TLSv1.2"
>
>   ciphers="TLS_RSA_WITH_AES_128_CBC_SHA..."
>        ...
>
> Removing older ciphers this way is effective (they don't show up in 
> SSL Labs test), but SSL Labs test still indicates support for SSL 3 
> and not TLS 1.2 (nor 1.1 for that matter).
>

https://blogs.oracle.com/java-platform-group/entry/diagnosing_tls_ssl_and_https

Short answer: JDK 6 doesn't support TLS1.1 or 1.2 yet.  I wonder if you 
have a log message in catalina.out or localhost.xxx where it complains 
about failing to set the protocols due to syntax error or the like.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%