Hi Rob,
Please add the following ciphers and attributes for forward secrecy to ADSelfService Plus.
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA"
allowUnsafeLegacyRenegotiation="false" server="Adselfservice Plus"
sslProtocol="TLS" sslProtocols="TLSv1.2"
compression="off"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA"
allowUnsafeLegacyRenegotiation="false" server="Adselfservice Plus"
sslProtocol="TLS" sslProtocols="TLSv1.2"
compression="off"
Example:
<Connector SSLEnabled="true" acceptCount="100" compression="off"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" clientAuth="false" connectionTimeout="20000" debug="0" disableUploadTimeout="true" enableLookups="false" keystoreFile="./conf/server.keystore" keystorePass="adventnet" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" name="SSL" port="9251" scheme="https" secure="true" allowUnsafeLegacyRenegotiation="false" server="Adselfservice Plus" slProtocol="TLS" sslProtocols="TLSv1.2"/>
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" clientAuth="false" connectionTimeout="20000" debug="0" disableUploadTimeout="true" enableLookups="false" keystoreFile="./conf/server.keystore" keystorePass="adventnet" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" name="SSL" port="9251" scheme="https" secure="true" allowUnsafeLegacyRenegotiation="false" server="Adselfservice Plus" slProtocol="TLS" sslProtocols="TLSv1.2"/>
Please follow the steps provided below to modify SSL Connector, which is at the bottom of the 'server.xml' file.
* Stop ADSelfService Plus (Click Start --> All Programs --> ADSelfService
Plus --> Stop ADSelfService Plus).
Plus --> Stop ADSelfService Plus).
* Take a backup of existing "server.xml" file located at <installation directory>\conf
(C:\ManageEngine\ADSelfService Plus\conf) and edit the "server.xml" file to
modify the SSL Connector.
(C:\ManageEngine\ADSelfService Plus\conf) and edit the "server.xml" file to
modify the SSL Connector.
* Start ADSelfService Plus (Click on Start --> All Programs --> ADSelfService
Plus --> Start ADSelfService Plus).
Plus --> Start ADSelfService Plus).