|
|
|
The <sslparams> section in the server.conf file contains the settings required to enable Secure Sockets Layer (SSL) communications between the SPS and destination servers.
The SSL configuration section is listed following.
<sslparams>
# Set the SSL protocol version to support: SSLv3, TLSv1 # WARNING: SSL version 2 is no longer supported. versions="SSLv3"
ciphers="-RSA_With_Null_SHA,+RSA_With_Null_MD5,-RSA_With_RC4_SHA,+RSA_With_RC4_MD5,+RSA_With_RC2_CBC_MD5,+RSA_With_DES_CBC_SHA,+RSA_With_DES_CBC_MD5,+RSA_With_3DES_EDE_CBC_SHA,+RSA_With_3DES_EDE_CBC_MD5,+RSA_Export_With_RC4_40_MD5,-RSA_Export_With_DES_40_CBC_SHA,+RSA_Export_With_RC2_40_CBC_MD5,-DH_RSA_With_DES_CBC_SHA,-DH_RSA_With_3DES_EDE_CBC_SHA,-DH_RSA_Export_With_DES_40_CBC_SHA,-DH_DSS_With_DES_CBC_SHA,-DH_DSS_With_3DES_EDE_CBC_SHA,-DH_DSS_Export_With_DES_40_CBC_SHA,-DH_Anon_With_RC4_MD5,-DH_Anon_With_DES_CBC_SHA,-DH_Anon_With_3DES_EDE_CBC_SHA,-DH_Anon_Export_With_DES_40_CBC_SHA,-DH_Anon_Export_With_RC4_40_MD5,-DHE_RSA_With_DES_CBC_SHA,-DHE_RSA_With_3DES_EDE_CBC_SHA,-DHE_RSA_Export_With_DES_40_CBC_SHA,-DHE_DSS_With_DES_CBC_SHA,-DHE_DSS_With_3DES_EDE_CBC_SHA,-DHE_DSS_Export_With_DES_40_CBC_SHA" fipsciphers="+DHE_DSS_With_AES_256_CBC_SHA, +DHE_RSA_With_AES_256_CBC_SHA, +RSA_With_AES_256_CBC_SHA, +DH_DSS_With_AES_256_CBC_SHA, +DH_RSA_With_AES_256_CBC_SHA, +DHE_DSS_With_AES_128_CBC_SHA, +DHE_RSA_With_AES_128_CBC_SHA, +RSA_With_AES_128_CBC_SHA, +DH_DSS_With_AES_128_CBC_SHA, +DH_RSA_With_AES_128_CBC_SHA, +DHE_DSS_With_3DES_EDE_CBC_SHA, +DHE_RSA_With_3DES_EDE_CBC_SHA, +RSA_With_3DES_EDE_CBC_SHA, +DH_DSS_With_3DES_EDE_CBC_SHA"
# Covalent SSL CA certificate bundle and certs path to be converted # The bundle and/or certs located at defined location will be converted # to binary (DER) format and loaded as SSLParams. # NOTE: Only put Base64 (PEM) encoded cert files/bundles in the covalent # certificate directory. cacertpath="C:\Program Files\CA\secure-proxy\SSL\certs" cacertfilename="C:\Program Files\CA\secure-proxy\SSL\certs\ca-bundle.cert"
</sslparams>
The SSL parameters include:
Determines the SSL versions supported by the SPS. The entry can be one or more of the following.
If you specify more than one version, separate the values by commas.
Specifies the list of ciphers that can be enabled or disabled. If a cipher is enabled, it is preceded by a + symbol. If a cipher is disabled, it is preceded by a - symbol. If you specify more than one cipher, separate each entry by commas.
Specifies the path of the directory that contains the trusted certificate authority information. This path is relative to the install path of the SPS. This value is configured when you run the configuration wizard during the SPS installation; do not change it.
Specifies the fully qualified path name of the file that contains the Certificate Authority bundle of certificates. This file must have a file extension of .cer or .cert, and must be PEM encoded. It must also include the full path to the Certificate Authority (CA) bundle. This value is configured when you run the configuration wizard during the SPS installation.
Specifies the duration, in milliseconds, that the SSL session ID is cached for re-use by the SPS HTTPS client. When a user requests a file via an HTTPS connection, an SSL handshake occurs and an SSL session ID is created. This SSL session ID is used by the SPS and the backend server to identify a user session. When the HTTPS connection is terminated for the user, the SPS caches the SSL session ID for the maximum duration specified by this parameter.
When the same user requests a new HTTPS connection to the backend server, the user can send the SSL session ID that is cached for a faster response. In this case, the SSL session ID provided by the user is compared with the cached SSL session ID. If the SSL session ID is available in cache, the new HTTPS connection is established faster.
Default: 120000 milliseconds
| Copyright © 2011 CA. All rights reserved. | Email CA Technologies about this topic |