Dear forum,
i have a small question:
Our security scanner say about Axway Synchrony Gateway Inrechange embedded HTTPS-Server:
“SSL Weak Cipher Suites Supported.”
Description:The remote host supports the use of SSL ciphers that offer either weak
encryption or no encryption at all.
Note: This is considerably easier to exploit if the attacker is on the
same physical network.
Do you know, how i can disable it? The general solution, what i found for Apache/Tomcat, was it:
Disable weak SSL ciphers.
Apache:
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
Tomcat:
ciphers=SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_WITH_3DES_
EDE_CBC_SHA
But the main question - which Axway-Configuration file must be edited?
Thanks in advance for your help.
BR,
Roman
P.S.: I got today this answer from “Gateway”-topic ( Julien -many thanks for it!):
.. it seems to be possible to restrict the use of weak encryption algorithms with SSL by editing the build/conf/sslciphersuites.xml to comment the cipher suite you don’t need. ..
But this file is missing on my system?!
continue reading.....