Advanced Authentication: Enforcing Specific Strong SSL Ciphers.

Products

• CA Advanced Authentication

Issue/Introduction

Previously, the arcotcommon.ini file did not support specifying a granular combination of protocol and cipher suites for SSL connections. Only high-level SSL protocols could be defined in the [ssl/config] section, as shown below:

[ssl/config]

sslContextAlgorithm=TLS

It is now possible to specify a granular combination of protocols and cipher suites for SSL connections within arcotcommon.ini.

------ Risk Authentication Server Configuration:

Use the following parameters to configure the Risk Authentication server:

RiskAuthSupportedProtocols: Specifies the list of supported protocols (e.g., tlsv1.2). Use lowercase only.

RiskAuthCipherSuites: Specifies the list of supported cipher suites. Refer to the OpenSSL Cipher documentation " OpenSSL Documentation " for valid names.

Example Configuration:

  [ssl/config]

  RiskAuthSupportedProtocols=tlsv1.2

  RiskAuthCipherSuites=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES128-GCM-SHA256

This configuration restricts the Risk Authentication server to communication using only the TLS 1.2 protocol with the specified cipher suites.

------ Strong Authentication Server Configuration:

Use the following parameters to configure the Strong Authentication server:

StrongAuthSupportedProtocols: Specifies the list of supported protocols (e.g., tlsv1.2). Use lowercase only.

StrongAuthCipherSuites: Specifies the list of supported cipher suites. Refer to the OpenSSL Cipher documentation " OpenSSL Documentation" for valid names.

Example Configuration:

  [ssl/config]

  StrongAuthSupportedProtocols=tlsv1.2

  StrongAuthCipherSuites=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES128-GCM-SHA256

 

Environment

Release: 9.x 

Component: CA Strong Authentication and CA Risk Authentication

Cause

Vulnerability scans would show that Advanced Authentication allowed SSL connections with the back end products using weak ciphers. 

Resolution

This configuration allows for the restriction of SSL connections to strong cipher suites when clients communicate with back-end servers, preventing alerts regarding weak cipher usage.

Additional Information

Required Restarts: Configuration changes require a restart of the following Advanced Authentication components:

1. arcotuds. 

2. arcotadmin

3. arcotwebfort

4. arcotriskfort