<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello all, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m following the InCommon Baseline Expectations 2 that is required for our IdPs. I see that one of the requirements is related to encryption. Link here:
<a href="https://spaces.at.internet2.edu/display/federation/be2-guide-encrypt-endpoints">
https://spaces.at.internet2.edu/display/federation/be2-guide-encrypt-endpoints</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I run the SSLLab Server Test on our IdP domain I get a score of a B. They require a score of an A or higher. I am getting a B because we support TLS 1.1. It seems like in order to get a higher score I need to not support TLS 1.0 and
1.1 and start supporting TLS 1.2. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking through the Shibboleth user group I saw one conversation where some participants did not agree with InCommon on this requirement (attached). That was back in March 2021 so I wanted to start a new conversation on this.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What are your thoughts or plans with this? I wanted to reach out and see what everyone is doing in regards to this. Are you all moving to TLS 1.2 to score an ‘A’? Or are you just staying at a score of a ‘B’ for this and moving on? Any concerns
you have with moving an IdP from TLS 1.0/1.1 to TLS 1.2? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">InCommon wants this all done by mid-July so I’m thinking some of you already started this.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Brent <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:13.0pt;font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">Brent Goebel</span></b><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">Systems Engineer III</span><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">Information Technology </span><span style="color:#830033;mso-fareast-language:ZH-CN">‖</span><span style="font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ZH-CN"> </span><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN"> University
of Denver</span><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">2100 </span><span style="font-family:"Times New Roman",serif;color:black;mso-fareast-language:ZH-CN">South High Street </span><span style="color:#830033;mso-fareast-language:ZH-CN">‖</span><span style="font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ZH-CN"> </span><span style="font-family:"Times New Roman",serif;color:black;mso-fareast-language:ZH-CN">Denver
CO 80210</span><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN"><a href="mailto:brent.goebel@du.edu"><span style="color:blue">brent.goebel@du.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="253" height="84" style="width:2.6354in;height:.875in" id="Picture_x0020_1" src="cid:image001.jpg@01D76DB9.DA2600E0" alt="DULogo_IT"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>