Article ID: 5116
Reviewed: 2017-11-13

Product Version:
AhsayCBS: 7.3 to 7.x
OS: All platforms

ATTENTION 1st January, 2022: v7 officially End-of-Life [details]

This article provides instructions on how to provide a higher level of SSL security for AhsayCBS.

To disable all weak cipher suite on AhsayCBS:

1. Edit the server.xml file found under ${Install-Home}\conf
   
   
   • Open 'server.xml' with a text editor:
     
     

     server.xml

     ...

     <Service name="Catalina">

     <Connector port="80" protocol="HTTP/1.1" maxKeepAliveRequests="1000" disableUploadTimeout="true" ...

     redirectPort="443" minSpareThreads="50" maxThreads="2000" acceptCount="200" ...

     connectionTimeout="120000" address="0.0.0.0" socketBuffer="16384" />

     <Connector port="443" SSLCipherSuite="HIGH:!aNULL:!MD5" protocol="HTTP/1.1" ...

     ...

     ...

   • Update the SSLCipherSuite parameter with:
     
     SSLCipherSuite="ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:EDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK"
     
     

     server.xml

     ...

     <Service name="Catalina">

     <Connector port="80" protocol="HTTP/1.1" maxKeepAliveRequests="1000" disableUploadTimeout="true" ...

     redirectPort="443" minSpareThreads="50" maxThreads="2000" acceptCount="200" ...

     connectionTimeout="120000" address="0.0.0.0" socketBuffer="16384" />

     <Connector port="443" SSLCipherSuite="ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-                 GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:                 DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:EDH+AESGCM:ECDHE-                 RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-                 ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-                 RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-                 AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:                 DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK" protocol="HTTP/1.1" ...

     ...

     ...

   • Save and exit from the text editor.
   
   
2. Restart the AhsayCBS service.

improve, security, cert, ssl, freak, weak, cipher, ciphersuite, suite, key