IM Connector server console: how to disable TLS v1/v1.1 ?

Products

• CA Identity Suite

Issue/Introduction

Connector server console (port 20443) supports TLS v1 and TLS v1.1 protocols.

Is it possible to disable the above protocols, as they are vulnerable?

Environment

Release : 14.x

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Resolution

At the moment there is no configuration in the IM Connector Server to disable TLSv1/1.1 on JCS console.

The only way to do this is via java platform configuration (jdk.tls.disableAlgorithms):
https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-3/reference/advanced-configuration-options/domain-configuration/tls-configuration.html#concept.dita_5a99004c2006c1391c8e361760325fb57fe2f0a3_PlatformLevelTLSProtocolSettingforJCS.

This option is only available for standalone connector servers, and not for vApp based ones.

Please also note that this options also disables all client side TLS v1/1.1 support in JCS, so it can be used only when there are no java connector endpoints which require TLSv1/TLSv1.1