<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The context here is an ill-advised policy interpretation by InCommon that all IDP and SP operators (in order to achieve "current and community-trusted transport layer encryption") will need to hit an "A" when automatically scanned by Qualys SSL labs in order
to meet baseline expectations.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Support for TLS 1.0 or 1.1 automatically cap your score to a "B".</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I've expressed the same issue Ian did below: that this is a function of which clients and browsers you need to support, falls outside the purview of the IDP or SP operator, and that some of our federation participants might not be able to hit this quite yet.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I've heard absolutely nothing from InCommon in response.</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ian Young <ian@iay.org.uk><br>
<b>Sent:</b> Wednesday, March 17, 2021 4:02 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> [External] Re: jetty</font>
<div> </div>
</div>
<div class="" style="word-wrap:break-word; line-break:after-white-space"><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 2021-03-17, at 20:43, Donald Lohr <<a href="mailto:lohrda@jmu.edu" class="">lohrda@jmu.edu</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class=""><span class="" style="font-family:Menlo-Regular; font-size:13px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none; float:none; display:inline!important">Hypothetically
speaking, is there a need for the jetty service used by a Shibboleth IdP to allow tls1 or tls1.1 ?</span></div>
</blockquote>
</div>
<div class=""><br class="">
</div>
It's going to end up being a question of what you need to be able to talk to the IdP with: browsers (for front channel) and SP implementations (if you need the back channel).
<div class=""><br class="">
</div>
<div class="">If all of the browsers your users need to use can use modern TLS, then you're probably in the clear.<br class="">
<div class=""><span class="x_Apple-style-span" style="border-collapse:separate; color:rgb(0,0,0); font-family:Helvetica; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; border-spacing:0px">
<div class="" style="word-wrap:break-word"><span class="x_Apple-style-span" style="border-collapse:separate; color:rgb(0,0,0); font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; border-spacing:0px">
<div class=""><span class="x_Apple-tab-span" style="white-space:pre"><br class="x_Apple-interchange-newline">
</span> -- Ian<br class="">
</div>
<div class=""><span class="x_Apple-style-span" style="font-size:medium"><br class="">
</span></div>
</span></div>
</span><br class="x_Apple-interchange-newline">
<br class="x_Apple-interchange-newline">
</div>
<br class="">
</div>
</div>
</body>
</html>