[External] Re: jetty

[Domingues, Em]

The context here is an ill-advised policy interpretation by InCommon that all IDP and SP operators (in order to achieve "current and community-trusted transport layer encryption") will need to hit an "A" when automatically scanned by Qualys SSL labs in order to meet baseline expectations.

Support for TLS 1.0 or 1.1 automatically cap your score to a "B".

I've expressed the same issue Ian did below: that this is a function of which clients and browsers you need to support, falls outside the purview of the IDP or SP operator, and that some of our federation participants might not be able to hit this quite yet.

I've heard absolutely nothing from InCommon in response.
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Ian Young <ian at iay.org.uk>
Sent: Wednesday, March 17, 2021 4:02 PM
To: Shib Users <users at shibboleth.net>
Subject: [External] Re: jetty


On 2021-03-17, at 20:43, Donald Lohr <lohrda at jmu.edu<mailto:lohrda at jmu.edu>> wrote:

Hypothetically speaking, is there a need for the jetty service used by a Shibboleth IdP to allow tls1 or tls1.1 ?

It's going to end up being a question of what you need to be able to talk to the IdP with: browsers (for front channel) and SP implementations (if you need the back channel).

If all of the browsers your users need to use can use modern TLS, then you're probably in the clear.

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210318/23b462c1/attachment.htm>