Configuring Cipher suites

This topic describes how to manually select Cipher Suites that should be accepted by BigFix Inventory server.

About this task

The list of vulnerable Cipher Suites is updated regularly. Accepted cipher suites are updated with new Java service packs so that vulnerable ciphers are not included. You can manually select the ciphers that should be enabled to address security risks before it is addressed by Java service pack or to comply with the security policy.

Below is the recommendation based on internal security scans.

To select the list of accepted cipher suites, modify the installation_directory/wlp/usr/servers/server1/customization.xml file, to make the file contents look like below:

<server>
<ssl id="defaultSSLConfig" enabledCiphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"/>
</server>

Restart BigFix Inventory application after you make the changes.