3.10 Enabling Perfect Forward Secrecy

For information about Perfect Forward Secrecy and prerequisites for enabling it, see Section 7.3, Enabling Perfect Forward Secrecy.

  1. Using command prompt, change to the Tomcat configuration directory:

    Linux: /opt/novell/nam/idp/conf

    Windows Server 2008: \Program Files (x86)\Novell\Tomcat\conf

  2. Open the server.xml file. Search for the cipher attribute in the <Connectors> element and modify the list to include only the following cipher suites:

    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 
TLS_RSA_WITH_AES_256_CBC_SHA256 
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 
TLS_RSA_WITH_AES_128_CBC_SHA256 
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256

    For example, see Section 3.19.1, server.xml.