Is it possible to restrict the communication protocol for the ports 509, 5250, and 8443 to TLSv1.2?
509 : EEM (CA Directory, itechpoz)
5250: EEM GUI
8443: CA WCC Tomcat port (the default for non-SSL is 8080; the default for SSL is 8443)
sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"
parameter
Example Path locations:
Linux:
/opt/CA/WorkloadAutomationAE/wcc
Windows:
C:\Program Files\CA\WorkloadAutomationAE\wcc
Commands to stop and start WCC:
Linux Stop command:
- source Autosys environment:unisrvcntr stop CA-wcc CA-wcc-services
Windows Stop command:
Go to Windows services and stop CA-wcc-services
Linux Start command:
- source Autosys environment:unisrvcntr start CA-wcc CA-wcc-services
Windows start command:
Go to Windows services and start CA-wcc
Example from igateway.conf:
<secureProtocol>TLSv1_2</secureProtocol>
<cipherlist>-ALL:HIGH:MEDIUM:!RC4</cipherlist>
Example Path locations:
Linux:
/opt/CA/SharedComponents/iTechnology
Windows:
C:\Program Files\CA\SharedComponents\iTechnology
Command to stop and start iGateway
Linux Stop Command:
run as root$IGW_LOC/S99igateway stop
Windows Stop Command:
Go to Windows services and stop CA iTechnology iGateway
Linux Start Command:
run as root$IGW_LOC/S99igateway start
Windows Start Command:
Go to Windows services and Start CA iTechnology iGateway
TLSv1.2 is supported in EEM 12.6 for CA Directory
(This is because CALDAP which is used to communicate between iGateway and CA Directory does not support it in releases prior to 12.6)
protocol = tls
parameterprotocol = tlsv12
The same cipherlist document above can be used.
Example from itechpoz.dxc:#
# eiam repository
#
set ssl = {
cert-dir = "config/ssld/personalities"
ca-file = "config/ssld/itechpoz-trusted.pem"
cipher = "ALL:!EXPORT40:!ADH:!EXP:!LOW:!RC4:!SSLv3:!SSLv2"
protocol = tlsv12
};
Example Path locations:
Linux:
/opt/CA/SharedComponents/Directory/dxserver/config\ssld
Windows:
C:\Program Files\CA\SharedComponents\Directory\dxserver\config\ssld
Command to stop and start CA Directory
Linux Stop Command:su - dsa
cd /opt/CA/SharedComponents/CADirectory/dxserver/bin
./dxserver stop all
Windows Stop Command:
Go to Windows services and stop CA Directory - itechpoz
Linux Start Command:su - dsa
cd /opt/CA/SharedComponents/CADirectory/dxserver/bin
./dxserver start all
Windows Start Command:
Go to Windows services and Start CA Directory - itechpoz