If the directory/file paths specified in this guide do not exist in your WSO2 product, see Directory Structure of WSO2 Products to locate the paths applicable to your product.
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 10 Next »

The transport level security protocol of the Tomcat server is configured in the <PRODUCT_HOME>/conf/tomcat/catalina-server.xml file. Note that the ssLprotocol attribute is set to "TLS" by default. 
See the following topics for detailed configuration options:

Disabling SSL 

It is necessary to disable SSL in Carbon servers because of a bug ( Poodle Attack) in the SSL protocol that could expose critical data encrypted between clients and servers. The Poodle Attack makes the system vulnerable by telling the client that the server does not support the more secure TLS (Transport Layer Security) protocol, and thereby forces it to connect via SSL. The effect of this bug can be mitigated by disabling SSL protocol for your server.

Follow the steps given below to disable SSL support on WSO2 Carbon based servers.

  1. Open the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file. 
  2. Make a backup of the catalina-server.xml file and stop the Carbon server.
  3. Find the Connector configuration corresponding to TLS (usually, this connector has the port set to 9443 and the sslProtocol as TLS). Remove the sslProtocol="TLS" attribute and replace it with sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" as shown below.

    <Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
                    port="9443"
                    bindOnInit="false"
                    sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" 
  4. Start the server.

    In some Carbon products, such as WSO2 ESB and WSO2 API Manager, pass-thru transports are enabled. Therefore, to disable SSL in such products, the axis2.xml file stored in the <PRODUCT_HOME>/repository/conf/axis2/ directory should also be configured.

To test if SSL is disabled:

  1. Download TestSSLServer.jar from here.
  2. Execute the following command to test the transport:

    java -jar TestSSLServer.jar localhost 9443 
  3. The output of the command after disabling SSL is shown below.

    Supported versions: TLSv1.0
    Deflate compression: no
    Supported cipher suites (ORDER IS NOT SIGNIFICANT):
      TLSv1.0
         RSA_EXPORT_WITH_RC4_40_MD5
         RSA_WITH_RC4_128_MD5
         RSA_WITH_RC4_128_SHA
         RSA_EXPORT_WITH_DES40_CBC_SHA
         RSA_WITH_DES_CBC_SHA
         RSA_WITH_3DES_EDE_CBC_SHA
         DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
         DHE_RSA_WITH_DES_CBC_SHA
         DHE_RSA_WITH_3DES_EDE_CBC_SHA
         RSA_WITH_AES_128_CBC_SHA
         DHE_RSA_WITH_AES_128_CBC_SHA
         RSA_WITH_AES_256_CBC_SHA
         DHE_RSA_WITH_AES_256_CBC_SHA

Disabling weak ciphers

A cipher is an algorithm for performing encryption or decryption. When you set the sslprotocol of your server to TLS, the TLS and the default ciphers get enabled without considering the strength of the ciphers. This is a security risk as weak ciphers, also known as EXPORT ciphers, can make your system vulnerable to attacks such as the Logjam attack on Diffie-Hellman key exchange. The Logjam attack is also called the Man-in-the-Middle attack. It downgrades your connection's encryption to a less-secured level (e.g., 512 bit) that can be decrypted with sufficient processing power.

To prevent these types of security attacks, it is encouraged to disable the weak ciphers. You can enable only the ciphers that you want the server to support in a comma-separated list in the ciphers  attribute. Also, if you do not add this cipher attribute or keep it blank, the browser will support all the SSL ciphers by JSSE. This will enable the weak ciphers.

  1. Open the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file.
  2. Make a backup of the catalina-server.xml  file and stop the WSO2 product server.
  3. Add the cipher  attribute to the existing configuration in the catalina-server.xml  file by adding the list of ciphers that you want your server to support as follows: ciphers="<cipher-name>,<cipher-name>". See the example given below.

    For Tomcat version 7.0.59 and JDK version 1.7:
    ciphers="TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA"  
    
    For Tomcat version 7.0.59 and JDK version 1.8:
    ciphers="TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" 

    See the list of supported cipher suites.

  4. Start the server.
  5. To verify that the configurations are all set correctly, download and run the TestSSLServer.jar.

    $ java -jar TestSSLServer.jar localhost 9443

    Note the following when you run TestSSLServer.jar:

    • The "Supported cipher suites" section in the output does not contain any EXPORT ciphers.

    • When you use the supported cipher suites listed here, the BEAST attack status will be shown as vulnerable. Note that this is a client-side vulnerability caused by the TLSv1 protocol. You can make the BEAST status protected by removing TLSv1, which will make clients with TLSv1 unusable. Therefore, it is recommended to fixed this from the client side.

Firefox 39.0 onwards does not allow to access Web sites that support DHE with keys less than 1023 bits (not just DHE_EXPORT). 768/1024 bits are considered to be too small and vulnerable to attacks if the hacker has enough computing resources. 

Tip: To use AES-256, the Java JCE Unlimited Strength Jurisdiction Policy files need to be installed. Downloaded them from http://www.oracle.com/technetwork/java/javase/downloads/index.html.

Tip: From Java 7, you must set the jdk.certpath.disabledAlgorithms property in the <JAVA_HOME>/jre/lib/security/java.security file to jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048. It rejects all algorithms that have key sizes less than 2048 for MD2, DSA and RSA.

Note that this tip is not applicable when you are disabling weak ciphers in WSO2 Identity Server.

Configuring the PassThrough transport

If you have enabled the PassThrough transport, do the following:

  1. Stop the server.

  2. Open the <ESB_HOME>/repository/conf/axis2/axis2.xml file and based on the JDK version you are using add the specified parameter under the <transportReceiver name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLListener"> element as well as under the <transportSender name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLSender"> element.

    • If you are using JDK 1.6, add the following parameter:

      <parameter name="HttpsProtocols">TLSv1</parameter> 
    • If you are using JDK 1.7, add the following parameter:

      <parameter name="HttpsProtocols">TLSv1,TLSv1.1,TLSv1.2</parameter> 
  3. Start the server.

  4. Test the pass-through transport using the following command with the corresponding port:

    $ java -jar TestSSLServer.jar localhost 8243
  • No labels