CA Workload Automation AE - Business Agents (AutoSys)CA Workload Automation AE - System Agent (AutoSys)CA Workload Automation AE - Scheduler (AutoSys)Workload Automation AgentAutosys Workload Automation
Issue/Introduction
1. Why doesn't WCC's server.xml include a cipher?
2. What are the ciphers supported by the WCC ?
Environment
Release : 11.4
Component : WORKLOAD CONTROL CENTER
Resolution
R12 will change the serverl.xml settings so that weak ciphers are disabled by default. If customers want to add weak ciphers, they will be free to do so.
The following link shows an example of adding a cipher entry into the server.xml files for WCC. https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/intelligent-automation/workload-automation-ae-and-workload-control-center/11-3-6-SP8/installing/ca-wcc-installation/customize-secure-access-to-ca-wcc.html
According to SSL Labs, a leading authority on SSL security, the ciphers (strong) that should be allowed are: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 All ciphers other than these are considered weak. However, the Java distribution we provide does not support the 256-bit ciphers due to export restrictions. With that in mind, we will be configuring the AutoSys 12.0 Tomcat servers to support only the strong 128-bit ciphers: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 ----