EDR: How to define the supported TLS versions
search cancel

EDR: How to define the supported TLS versions

book

Article ID: 285748

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To limit or allow the exact versions of TLS that are supported by the EDR cluster.

Environment

  • EDR: 7.x and Higher

Resolution

  1. Edit: /etc/cb/nginx/conf.d/includes/cb.server.base.body
  2. Edit the "ssl_protocols" line, located in the "server" section:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  1. Add or remove the supported versions of TLS as necessary.
  2. Once the master server and all minions have been modified, restart the cluster. 

Additional Information

  • TLS 1.3 is currently not supported
  • Changes should be made on all cluster nodes (master + minions)
  • Server cluster, endpoint, and all networking devices between them support the specified protocols