<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi all, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So I started to work on the InCommon Baseline 2 expectation that requires disabling TLS 1.0/1.1. I’m on Shibboleth IdP version 4.0.1.1 with Jetty version 9.4.36.v20210114.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I followed the steps for TLS Ciphers in the Shibboleth Jetty94 documentation:
<a href="https://wiki.shibboleth.net/confluence/display/IDP4/Jetty94#Jetty94-TLSCiphers">
https://wiki.shibboleth.net/confluence/display/IDP4/Jetty94#Jetty94-TLSCiphers</a>. I created the etc/tweak-ssl.xml using the example text provide since it is set to exclude TLS 1.0 and 1.1.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After doing that, I run a TLS check again and it still says TLS 1.0 and TLS 1.1 are enabled.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking around I found this conversation that is related but has to do with Jetty 10 (<a href="http://jetty.4.x6.nabble.com/TLSv1-and-TLSv1-1-are-disabled-by-Jetty-10-td4968508.html">http://jetty.4.x6.nabble.com/TLSv1-and-TLSv1-1-are-disabled-by-Jetty-10-td4968508.html</a>).
Following this thread, I tried adding the following to the start.ini.<o:p></o:p></p>
<p class="MsoNormal"><i># Module: https<br>
# Adds HTTPS protocol support to the TLS(SSL) Connector<br>
# --------------------------------------- <br>
--module=https<br>
etc/tweak-ssl.xml<o:p></o:p></i></p>
<p class="MsoNormal"><i><o:p> </o:p></i></p>
<p class="MsoNormal">In doing so, running the TLS check still says TLS 1.0/1.1 are enabled.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I also tried out the steps noted in Jetty 9.4 documentation under Disabling/Enabling Specific Cipher Suites in this link:
<a href="https://www.eclipse.org/jetty/documentation/jetty-9/index.html#configuring-ssl.html#">
https://www.eclipse.org/jetty/documentation/jetty-9/index.html#configuring-ssl.html#</a> This is similar to the other ones tried above. But it didn’t work either. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m stuck. Am I missing something? Can someone please share the configuration and changes they made to Jetty 9.4 to exclude TLS 1.0 & 1.1?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Brent<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:13.0pt;font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">Brent Goebel</span></b><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">Systems Engineer III</span><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN">Information Technology </span><span style="color:#830033;mso-fareast-language:ZH-CN">‖</span><span style="font-family:"Times New Roman",serif;color:#1F497D;mso-fareast-language:ZH-CN"> </span><span style="font-family:"Times New Roman",serif;color:#201F1E;mso-fareast-language:ZH-CN"> University
of Denver</span><span style="color:#201F1E;mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>