TLSv1.0 and TLSv1.1 removal impact in SSO for Siteminder applications

Products

• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

 

When planning to disable TLSv1.0 and TLSv1.1 on the Policy Server and Federation servers, what would be the impact on the Siteminder applications that are using these protocols?

 

Environment

 

Policy Server 12.8 SP6

 

Resolution

 

Application calls can not reach Policy Servers directly.

A Policy Server has to be contacted via an Agent only.

All the Agents to Policy Server communication are established over the tunnel calls only (which are Back Channel communication).

So there is no direct communication from any application reaching the Policy Server. And these are not TLS connections.