<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
When I analyzed the TLS usage for Oregon State University's IDP, the only usage of TLSv1 and TLSv1.1 were by security scanners. Over a weeklong period, all of our actual users (browsers hitting the SAML endpoints) were connecting with TLSv1.2+.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We ran into the same kind of problem that Scott mentioned though - back-channel connections to validate the CAS protocol service ticket from ancient servers on campus. We worked around this by cloning off a copy of the IDP that still allowed TLSv1 and was
firewalled to allow only those specific servers to connect. Our CISO will be putting the squeeze on those ancient servers, so this is a short-term workaround.<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
There is another way that old TLS clients are getting squeezed - CA root certs. Many of the original 20-year CA root certs have expired or are expiring. Your IDP website certificate may be signed through a certificate chain that cannot be validated by old
clients. We played with our certificate chain to find a path back to Comodo's AAA certificate (issued in 2004, expires in 2028), but that may not be possible in all circumstances.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Spencer Thomas <Spencer.Thomas@ithaka.org><br>
<b>Sent:</b> Thursday, March 18, 2021 9:53 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: [External] jetty</font>
<div> </div>
</div>
<div lang="EN-US">
<p><span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
And therein lies our issue with this update. We have many users who are in “developing nations”, and who may indeed be using old software on old hardware. If making the change disenfranchises something like 1.6% of our users, we may be constrained by the
business to not do so. We have not yet done the audit to actually know what that number is.</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<b>--</b></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<b>Spencer Thomas<br>
</b>Technical Architect <b>/</b> JSTOR and Artstor<br>
<a href="https://www.ithaka.org/"><span style="color:#0563C1">ITHAKA</span></a> <b>/</b> 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104<br>
Email: <a href="mailto:Spencer.Thomas@ithaka.org"><span style="color:#0563C1">Spencer.Thomas@ithaka.org</span></a></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
Voicemail: 734-887-7004</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<b><span style="font-size:12.0pt; color:black">From: </span></b><span style="font-size:12.0pt; color:black">users <users-bounces@shibboleth.net> on behalf of Ian Young <ian@iay.org.uk><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Thursday, March 18, 2021 at 12:48 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: [External] jetty</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
</div>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<span style="font-family:"-webkit-standard",serif; color:black">If you want better than B, that implies that you're giving up 1.6% of browser clients (worldwide, of all types). Interestingly, that seems to be only 0.23% of mobile browsers, it's the desktop
ones from 2013 and earlier that cause the problem. Of course numbers like that are only meaningful if you know whether their sample is representative of your clients.</span></p>
</div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<br>
<br>
</p>
</div>
</div>
</div>
</div>
</body>
</html>