TLS1.2 Protocol enable for IBM WebSphere with SSL Handshake Debug

 

TLS1.2 enable for IBM WebSphere with SSL Handshake Debug

>> Add below arguments on JVM java_options on NodeAgent, servers, Dmgr JVM's

-Dhttps.protocols=TLSv1.2

-Dcom.ibm.ssl.protocol=TLSv1.2

-Dcom.ibm.jsse2.overrideDefaultTLS=true

-Djdk.tls.client.protocols=TLSv1.2

-Djdk.tls.server.protocols=TLSv1.2

-Djavax.net.debug=ssl,handshake,data,trustmanager

JVM arguments, To ADD cacerts as Truststore & SSL debug

>> Add below arguments on JVM java_options on NodeAgent, servers, Dmgr JVM's

-Djavax.net.ssl.trustStore=$JAVA_HOME/java/8.0/jre/lib/security/cacerts 

-Djavax.net.ssl.trustStorePassword=changeit 

-Djavax.net.ssl.trustStoreType=jks 

-Dhttps.protocols=TLSv1.2

-Dcom.ibm.ssl.protocol=TLSv1.2

-Dcom.ibm.jsse2.overrideDefaultTLS=true

-Djdk.tls.client.protocols=TLSv1.2

-Djdk.tls.server.protocols=TLSv1.2

-Djavax.net.debug=ssl,handshake,data,trustmanager

IMPORT Certificate on cacerts file:

Command:

$JAVA_HOME/bin/keytool -import -trustcacerts -file certificate.cer -alias www.certificate.com -keystore $JAVA_HOME/java/8.0/jre/lib/security/cacerts

For LDAP SSL Handshake identificatation issue  "CWWIM4520E The 'javax.naming.CommunicationException: myldap.ibm.com:636"

>> Add below arguments on JVM java_options on NodeAgent, servers, Dmgr JVM's

-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true

Thanks :-)

SSL certificate supports Weak Ciphers/Encoding (3DES) (Apache 2.4 REDHAT)

Environment: Apache 2.4 (Linux)

Note: Take backup of /conf directives.

1. Locate to FileName: ssl.conf / http-ssl.conf file 

2. Add below parameters in virtual-host tag of  ssl.conf / http-ssl.conf with SSL Protocol.

(only TLSv1.2 is enabled)

*************************************************

SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!LOW:!EXP

*************************************************

3. Restart the JBoss server JVM.

4: Check with openssl command for ciphers

"openssl s_client -connect <IP/Host:443> -servername www.example.com" 

5. Reference link.

https://access.redhat.com/articles/2598471

Thanks :-)