How does a Symantec Endpoint Protection Manager (SEPM) use encryption and certificates to secure communications between itself, other managers and its clients? What types of encryption are used?
Each SEPM server generates its own self-signed certificate using a 2048 bit SHA256RSA key pair during its initial Management Server Configuration Wizard (MSCW) run. This certificate is stored in two locations and formats on the SEPM file system.
Client to Manager Communications
Managers host client to server communications through the SEPM Apache server. By default, the Apache server listens on TCP port 443 for encrypted HTTPS connections, and TCP port 8014 for unencrypted HTTP connections.
As of SEPM 14, newly installed managers are configured to accept HTTPS connections by default. For SEPM 12.1 managers, or 12.1 to 14 migrations, the SEPM Apache server can be configured to accept TLS encrypted HTTPS connections by following the steps in Enable HTTPS client-server communications.
Managers communicate with other managers through the SEPM Tomcat server over port 8443/HTTPS. The connection is secured using the server.crt and server.key files stored in C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf\ssl.
You can access the SEPM either through the local/remote Java console, or the Web console. The local and remote Java consoles are digitally signed by Symantec, using a code signing certificate issued by Symantec. The Web console is generated by the SEPM Tomcat server and is accessed over port 8443/HTTPS.
Reporting Server Communications
The SEPM Apache server hosts the Reporting Server site over port 8445/HTTPS. This site also provides the information in the Home, Monitors and Reports tabs of the SEPM Console.
Web Services Communications
The SEPM Tomcat server hosts the Web Services site over port 8446/HTTPS.
|Communications Type||Port/Protocol||Server Technology||Configuration File||Certificate File(s)|
|Client-Manager communications (secars and secreg)||443/HTTPS||Apache||C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf\ssl\sslForClients.conf||server.crt, server.key|
|Manager-Manager and Console-Manager communications||8443/HTTPS||Tomcat||C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\conf\server.xml||server.crt, server.key|
|Reporting Server||8445/HTTPS||Apache||C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf\ssl\ssl.conf||server.crt, server.key|
|Web Services||8446/HTTPS||Tomcat||C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\instances\sepm-api\conf\server.xml||
Managers digitally sign the policy files they host using the public key contained in the keystore.jks. Clients compare the digital signature on policy files to the certificate associated with the manager in their sylink.xml file.
Managers encrypt policies and content with the Twofish algorithm using the pre-shared key created with the first SEPM in the site. This password is not changed when a new certificate is imported into the SEPM using the Manage Server Certificate wizard. Clients decrypt the content using the kcs value in their sylink.xml file.