Disabling TLS 1.1 with Jetty 9.4

[Brent Goebel]

Hi all,

So I started to work on the InCommon Baseline 2 expectation that requires disabling TLS 1.0/1.1. I’m on Shibboleth IdP version 4.0.1.1 with Jetty version 9.4.36.v20210114.

I followed the steps for TLS Ciphers in the Shibboleth Jetty94 documentation: https://wiki.shibboleth.net/confluence/display/IDP4/Jetty94#Jetty94-TLSCiphers. I created the etc/tweak-ssl.xml using the example text provide since it is set to exclude TLS 1.0 and 1.1.

After doing that, I run a TLS check again and it still says TLS 1.0 and TLS 1.1 are enabled.

Looking around I found this conversation that is related but has to do with Jetty 10 (http://jetty.4.x6.nabble.com/TLSv1-and-TLSv1-1-are-disabled-by-Jetty-10-td4968508.html). Following this thread, I tried adding the following to the start.ini.
# Module: https
# Adds HTTPS protocol support to the TLS(SSL) Connector
# ---------------------------------------
--module=https
etc/tweak-ssl.xml

In doing so, running the TLS check still says TLS 1.0/1.1 are enabled.

I also tried out the steps noted in Jetty 9.4 documentation under Disabling/Enabling Specific Cipher Suites in this link: https://www.eclipse.org/jetty/documentation/jetty-9/index.html#configuring-ssl.html#  This is similar to the other ones tried above. But it didn’t work either.


I’m stuck. Am I missing something? Can someone please share the configuration and changes they made to Jetty 9.4 to exclude TLS 1.0 & 1.1?

Thank you,

Brent


Brent Goebel
Systems Engineer III
Information Technology ‖  University of Denver


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210701/d1ad8f0a/attachment.htm>