19.1.5 SSL Renegotiation

SSL renegotiation is the process of establishing a new SSL handshake over an existing SSL connection. SSL renegotiation can be initiated either by the SSL client or the SSL server. Initiating an SSL renegotiation on the client or the server requires different set of APIs. The renegotiation messages (ciphers and encryption keys) are encrypted and then sent over the existing SSL connection to establish another session securely and is useful in the following scenarios:

  • When you require a client authentication.

  • When you require a different set of encryption and decryption keys.

  • When you require a different set of encryption and hashing algorithms.

SSL renegotiation is enabled or disabled by the following parameter: "sun.security.ssl.allowUnsafeRenegotiation.

NOTE:By default, this parameter is disabled.

This is defined in a registry on Windows and a configuration file on SLES.

You can verify whether Identity Server, Access Gateway and Administration Console support secure renegotiation by using the following command:

openssl s_client -connect <IP address of the Access Manager component:port>

Port can either be 8443 or 443 based on Access Gateway configuration.

Enabling a Windows SSL Renegotiation

Perform the following steps to enable the SSL renegotiation on Windows 64-bit platform:

  1. Launch Registry Editor by executing the Start > Run regedit command.

  2. In the left pane of Registry Editor, navigate to My Computer > HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Java\.

  3. Double-click Options in the right pane of the Registry Editor.

  4. Search for the -Dsun.security.ssl.allowUnsafeRenegotiation string.

    • If -Dsun.security.ssl.allowUnsafeRenegotiation is available, set the value to true. For example, -Dsun.security.ssl.allowUnsafeRenegotiation=true

    • If -Dsun.security.ssl.allowUnsafeRenegotiation is not available, add -Dsun.security.ssl.allowUnsafeRenegotiation=true

  5. Go to C:\Program Files\Novell\Tomcat\conf\server.xml > Server > Service > Connector, then search for the connector 8443 and check if the connector has the port 8443.

  6. Add the allowUnsafeLegacyRenegotiation=true string.

  7. Restart Tomcat to enable the SSL renegotiation.

Perform the following steps to enable the SSL renegotiation on Windows 32-bit platform:

  1. Launch Registry Editor by executing the command regedit in Start > Run.

  2. In the left pane of Registry Editor, navigate to My Computer > HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Java\.

  3. Double-click Options in the right pane of registry editor.

  4. Search for the -Dsun.security.ssl.allowUnsafeRenegotiation string.

    • If -Dsun.security.ssl.allowUnsafeRenegotiation is available, set the value to true. For example, -Dsun.security.ssl.allowUnsafeRenegotiation=true.

    • If -Dsun.security.ssl.allowUnsafeRenegotiation is not available, add

      -Dsun.security.ssl.allowUnsafeRenegotiation=true.

  5. Go to C:\Program Files\Novell\Tomcat\conf\server.xml > Server > Service > Connector., then search for the connector 8443 and check if the connector has the port 8443.

  6. Add the allowUnsafeLegacyRenegotiation=true string.

  7. Restart Tomcat to enable the SSL renegotiation.

The following instructions explain how to disable the SSL renegotiation in Windows 32- bit and Windows 64-bit platform:

  1. Launch Registry Editor by executing the command regedit in Start > Run.

  2. In the left pane of Registry Editor, navigate to My Computer > HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Java\.

  3. Double-click Options in the right pane of registry editor.

  4. Search for the -Dsun.security.ssl.allowUnsafeRenegotiation string.

  5. In -Dsun.security.ssl.allowUnsafeRenegotiation, set the value to false. For example, -Dsun.security.ssl.allowUnsafeRenegotiation=false

  6. Restart Tomcat to disable the SSL renegotiation.

Enabling a Linux SSL Renegotiation

To enable the SSL renegotiation on SLES 11 SP2 and SP3, add the parameter JAVA_OPTS="${JAVA_OPTS} -Dsun.security.ssl.allowUnsafeRenegotiation=true in the configuration file /var/opt/novell/tomcat8/conf/tomcat8.confe if the parameter does not exist.

Restart Tomcat to enable SSL renegotiation.

To disable the SSL renegotiation on SLES 11 SP2 and SP3, add the parameter JAVA_OPTS="${JAVA_OPTS} -Dsun.security.ssl.allowUnsafeRenegotiation=false in the configuration file /var/opt/novell/tomcat8/conf/tomcat8.confe if the parameter does not exist if the parameter does not exist.

Restart Tomcat to disable SSL renegotiation.