X509 configuration in Jetty

[Ian Bobbitt]

On 12/15/17 11:11 AM, Cantor, Scott wrote:
> On 12/15/17, 10:35 AM, "users on behalf of Ian Bobbitt" <users-bounces at shibboleth.net on behalf of ibobbitt at globalnoc.iu.edu> wrote:
>
>> My production IdPs are behind an Apache proxy for other reasons, so I terminated the client certificate there (which can
>> renegotiate depending on path)
> Do you happen to know or have a concise summary of exactly what the state of renegotiation is in TLS? I really have lost track after the millionth advisory that it's unsafe, TLS extension to fix it, flags in clients to turn it off, etc.
>
My understand is that it's secure as of implementing RFC5746, which happened in OpenSSL 0.9.8m, GnuTLS 2.10.0, and NSS
3.12.6 in the 2010-2011 timeframe. Apache defaults to disallowing non-RFC5746 renegotiation since 2.2.15 and OpenSSL
0.9.8m <https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslinsecurerenegotiation> I believe browsers also disallow it.

TLS testers like https://www.ssllabs.com/ssltest/ (server side) and <https://www.ssllabs.com/ssltest/viewMyClient.html>
(client side) test to warn you if insecure renegotiation is allowed.

Of course, it's also possible I've missed something and the entire world of TLS is a sham.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4090 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20171215/947f702c/attachment.p7s>