15.7 Configuring the SSL Communication

By default, Access Manager supports the 128-bit SSL communication among the Administration Console, Identity Server, and browsers. The supported ciphers include:

  • SSL_RSA_WITH_RC4_128_MD5

  • TLS_DHE_DSS_WITH_AES_128_CBC_SHA

  • SSL_RSA_WITH_3DES_EDE_CBC_SHA

  • SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA

  • SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA

  • TLS_KRB5_WITH_3DES_EDE_CBC_SHA

  • TLS_KRB5_WITH_RC4_128_SHA

  • TLS_DHE_RSA_WITH_AES_128_CBC_SHA

  • SSL_RSA_WITH_RC4_128_SHA

  • TLS_RSA_WITH_AES_128_CBC_SHA

To enable weak ciphers (not recommended):

  1. Modify the server.xml file located in /opt/novell/nam/adminconsole/conf/.

  2. Add name of the ciphers that you want to enable in the ciphers tag.

To enable the strong 256-bit ciphers:

  1. Download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 7 from the Oracle website.

  2. Extract the zip file and replace the policy jars in /opt/novell/java/jre/lib/security/.

  3. Modify the server.xml file located in /opt/novell/nam/adminconsole/conf/.

  4. Add the 256-bit ciphers to the cipher attribute of <Connectors>.

    For example,

    <Connector NIDP_Name="connector" port="2443" maxHttpHeaderSize="8192" maxThreads="200" minSpareThreads="5" enableLookups="false" disableUploadTimeout="true" acceptCount="0" scheme="https" secure="true" clientAuth="false" sslProtocol="tls" URIEncoding="UTF-8" allowUnsafeLegacyRenegotiation="false" keystoreFile="/var/opt/novell/novlwww/.keystore" keystorePass="changeit" SSLEnabled="true" address="164.99.87.129" ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA" />

    For a complete list of supported cipher suites and their requirements, see “The SunJSSE Provider”.