How to configure Policy server AdminUI to use a unique Diffie-Hellman moduli of 2048 bits or greater

Products

• SITEMINDER

Issue/Introduction

A security assessment was performed on SiteMinder 12.8.2 and found following vulnerability on the policy server Administration UI console:

The remote host allows SSL/TLS connections with one or more Diffie-Hellman moduli less than or equal to 1024 bits.
Through cryptanalysis, a third party may be able to find the shared secret in a short amount of time (depending on modulus size and attacker resources). This may allow an attacker to recover the plaintext or potentially violate the integrity of connections.

How to reconfigure Policy server AdminUI to use a unique Diffie-Hellman moduli of 2048 bits or greater?

Environment

Release : 12.8.x

Component : SITEMINDER -POLICY SERVER

Resolution

In Java 8 you can specify custom DHE parameters, including DHE key size, for any application.
For SiteMnder AdminUI you need to change JAVA_OPTS parameter in standalone.conf.bat (Windows) or standalone.conf (Linux).

You may add the following string after other JAVA_OPTS statements:

Windows:
set "JAVA_OPTS=%JAVA_OPTS% -Djdk.tls.ephemeralDHKeySize=2048"
Linux:
JAVA_OPTS="$JAVA_OPTS -Djdk.tls.ephemeralDHKeySize=2048"