[External] jetty

[Andrew Jason Morgan]

When I analyzed the TLS usage for Oregon State University's IDP, the only usage of TLSv1 and TLSv1.1 were by security scanners.  Over a weeklong period, all of our actual users (browsers hitting the SAML endpoints) were connecting with TLSv1.2+.

We ran into the same kind of problem that Scott mentioned though - back-channel connections to validate the CAS protocol service ticket from ancient servers on campus.  We worked around this by cloning off a copy of the IDP that still allowed TLSv1 and was firewalled to allow only those specific servers to connect.  Our CISO will be putting the squeeze on those ancient servers, so this is a short-term workaround.

There is another way that old TLS clients are getting squeezed - CA root certs.  Many of the original 20-year CA root certs have expired or are expiring.  Your IDP website certificate may be signed through a certificate chain that cannot be validated by old clients.  We played with our certificate chain to find a path back to Comodo's AAA certificate (issued in 2004, expires in 2028), but that may not be possible in all circumstances.

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Spencer Thomas <Spencer.Thomas at ithaka.org>
Sent: Thursday, March 18, 2021 9:53 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: [External] jetty


[This email originated from outside of OSU. Use caution with links and attachments.]

And therein lies our issue with this update.  We have many users who are in “developing nations”, and who may indeed be using old software on old hardware.  If making the change disenfranchises something like 1.6% of our users, we may be constrained by the business to not do so. We have not yet done the audit to actually know what that number is.



--

Spencer Thomas
Technical Architect / JSTOR and Artstor
ITHAKA<https://www.ithaka.org/> / 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104
Email: Spencer.Thomas at ithaka.org<mailto:Spencer.Thomas at ithaka.org>

Voicemail: 734-887-7004











From: users <users-bounces at shibboleth.net> on behalf of Ian Young <ian at iay.org.uk>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, March 18, 2021 at 12:48 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: [External] jetty



If you want better than B, that implies that you're giving up 1.6% of browser clients (worldwide, of all types). Interestingly, that seems to be only 0.23% of mobile browsers, it's the desktop ones from 2013 and earlier that cause the problem. Of course numbers like that are only meaningful if you know whether their sample is representative of your clients.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210318/7c7c59ac/attachment.htm>