The transport level security protocol of the Tomcat server is configured in the
<PRODUCT_HOME>/conf/tomcat/catalina-server.xml file. Note that the ss
Lprotocol attribute is set to "TLS" by default.
See the following topics for detailed configuration options:
Testing SSL version 3 configuration for the Identity Server
SSL version 3 is disabled by default from IS 5.1.0 onwards. It is necessary to disable SSL version 3 in Carbon servers because of a bug (Poodle Attack) in the SSL version 3 protocol that could expose critical data encrypted between clients and servers. The Poodle Attack makes the system vulnerable by telling the client that the server does not support the more secure TLS (Transport Layer Security) protocol, and thereby forces it to connect via SSL 3.0. The effect of this bug can be mitigated when SSL version 3 protocol for your server is disabled.
The configuration that disables SSL version 3 can be found in the
<PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file under the
Connector configuration corresponding to TLS (usually, this connector has the port set to 9443 and the
sslProtocol as TLS).
sslEnabledProtocols parameter defines a comma-seperated list of TLS protocol versions to support for HTTPS connections.
You can follow the instructions below to ensure that SSL version 3 is disabled.
Execute the following command to test the transport:
The output of the command after disabling SSL version 3 is shown below.
After SSL version 3 is disabled:
Disable weak ciphers in Carbon server
A cipher is an algorithm for performing encryption or decryption. When the
sslprotocol is set to "TLS", only the TLS and default ciphers are enabled by default. However, note that the strength of the ciphers will not be considered when they are enabled. Therefore, to disable the weak ciphers, you must ensure that only the ciphers you want your server to support are entered for the
ciphers attribute in a comma-separated list. Also, if you do not add this cipher attribute or keep it blank, all SSL ciphers by JSSE will be supported by your server, thereby enabling the weak ciphers.
- Go to the
catalina-server.xmlfile in the
- Take a backup of the
catalina-server.xmlfile and stop the Carbon server (same as for disabling SSL version 3).
cipherattribute to the existing configuration in the
catalina-server.xmlfile by adding the list of ciphers that you want your server to support as follows:
Start the server.