How to Disable TLS 1.1 on CA Access Gateway (SPS) 12.8.08.01 and Older

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• SITEMINDER
• CA Single Sign-On

Issue/Introduction

This article details how to disable TLS v1.1 on SiteMinder Access Gateway servers running version 12.8.08.01 and older.

NOTE: SiteMinder 12.9 ships with TLS v1.1 disabled by default.

Environment

CA Access Gateway (SPS) 12.8SP8CR01 and older version on Windows and Linux

Cause

TLS v1.1 is vulnerable to a variety of attacks due to its reliance on weak SHA-1 hashing and the use of insecure cryptographic algorithms. It is typically advised to disable listeners from accepting connections using TLS v1.0 and TLS v1.1 (1).

Resolution

SiteMinder Access Gateway is composed of several different components, including the SiteMinder Agent for Apache Tomcat, Apache HTTP Server, and the Apache Tomcat Application Server. The following sections describe how to disable TLS v1.1 on each component.

Disable TLS v1.1 in Apache HTTP Server

In Apache HTTP Server, the TLS settings are stored in the httpd-ssl.conf file, within the virtual host configuration (2).

1. Log on to the SiteMinder Access Gateway server and browse to the following location:
   
   - Windows: <Install_Dir>\CA\secure-proxy\httpd\conf\extra
   - Linux:       <Install_Dir>/CA/secure-proxy/httpd/conf/extra
   
   
2. Open the httpd-ssl.conf file for editing.
3. Locate the SSLProtocol directive for each virtual host:
   
   <VirtualHost _{Name}_:{TCPPort}>
  ...
  SSLProtocol All -SSLv3 -SSLv2 -TLSv1
  ...
</VirtualHost>
   
   If SSLProtocol is set within the Default Virtual Host context, it applies to all virtual hosts defined in httpd-ssl.conf. However, if it is also defined within a specific virtual host, that value overrides the Default Virtual Host value. Therefore, it is critical to modify the SSLProtocol directive in both the Default Virtual Host and any specific virtual host where SSLProtocol has been explicitly defined. Virtual hosts that do not have SSLProtocol explicitly defined inherit the value from the Default Virtual Host and do not require a separate change.
   
   
4. Reference — SSLProtocol directive syntax:
   
   - All — Enables all protocols
   - +<protocol> — Adds the specified protocol
   - -<protocol> — Removes the specified protocol (applies even if All is used)
   
   
5. Update the SSLProtocol directive in all applicable virtual hosts as follows:
   
   SSLProtocol All -SSLv3 -SSLv2 -TLSv1 -TLSv1.1
   
   
6. Save the changes and restart Apache HTTP Server.

Disable TLS v1.1 in Apache Tomcat Application Server

In SiteMinder Access Gateway, the TLS settings for Tomcat are stored in the server.conf file.

1. Log on to the SiteMinder Access Gateway server and browse to the following location:
   
   - Windows: <Install_Dir>\CA\secure-proxy\proxy-engine\
   - Linux:      <Install_Dir>/CA/secure-proxy/proxy-engine/
   
   
2. Open the server.conf file for editing.
3. Locate the <sslparams> section:
   
   <sslparams>
  # Set the SSL protocol version to support: TLSv1.1 and TLSv1.2
  # NOTE: SSLv2 and SSLv3 are not recommended
  # NOTE: TLSv1 is not recommended - DE270536
  versions="TLSv1.2,TLSv1.1"
   
   
4. Remove TLSv1.1 from the versions directive:
   
   versions="TLSv1.2"
   
   
5. Save the changes to server.conf and restart the Access Gateway server.

Additional Information

1. RFC 8996 BCP 195: Deprecating TLS 1.0 and TLS 1.1
2. SSLProtocol Directive