tweaking security of IdP deployment

[Takeshi NISHIMURA]

FYI,

	sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"

is a notation for Tomcat 7.0.x (and 6.0.38 or later).

Best regards,
Takeshi

On 2014/12/13 8:52, IAM David Bantz wrote:
> SSLv3 is disabled in tomcat 6.0.16 by replacing
>          sslProtocol="TLS"
>          sslEnabledProtocols="TLSv1.1,TLSv1.2"
> with
>   sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
> in the Connector statement in tomcat's ~/conf/server.xml
> (though, as Chris Bongarats noted, support for 1.1 and 1.2 depends on JDK later than my 1.6).
>
> Thanks for the pointers.
>
> David Bantz
>
> On Fri, Dec 12, 2014 at 12:24 PM, Cantor, Scott <cantor.2 at osu.edu <mailto:cantor.2 at osu.edu>> wrote:
>
>     On 12/12/14, 8:32 PM, "IAM David Bantz" <dabantz at alaska.edu <mailto:dabantz at alaska.edu>> wrote:
>
>
>
>     >My IdP is running in tomcat 6.0.16-0 [updated SSL libraries
>     >mod_ssl.x86_64 1:2.2.3-91.el5,  openssl.i686  0.9.8e-31.el5_11,
>     >openssl.x86_64  0.9.8e-31.el5_11 and java-sun.x86_64
>     >1.6.0.45-1jpp.1.el5_9 ].
>
>     OpenSSL isn't relevant, and Java 6 is EOL. So you'd start by moving to
>     Java 7.
>
>     >Removing older ciphers this way is effective (they don't show up in SSL
>     >Labs test), but SSL Labs test still indicates support for SSL 3 and not
>     >TLS 1.2 (nor 1.1 for that matter).
>
>     I would ask Tomcat's list how to disable SSLv3 for certain if that isn't
>     doing it.
>
>     -- Scott