6.12 Updating the SSL Settings

The installer automatically configures the server for SSL communication over TLSv1.3 and TLSv1.2. A connector is created by default in the server.xml file, which is located in the path: opt/netiq/idm/apps/tomcat/conf/

<Connector port="https_port" protocol="HTTP/1.1" URIEncoding="UTF-8" maxThreads="200" enableLookups="true" scheme="https" secure="true" maxHttpHeaderSize="65536" SSLEnabled="true" sslProtocol="TLS" disableUploadTimeout="true" keystoreFile="path_to_keystore_file" keystorePass="keystore_password" useServerCipherSuitesOrder="true" ciphers="TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" sslEnabledProtocols="TLSv1.2+TLSv1.3" />

where:

sslProtocol

Specifies the SSL protocol used for communication.

keystoreFile

Specifies the path to the keystore file, for example, tomcat.ks file. Place the file in the respective directories based on your platform.

keystorePass

Specifies the password for the tomcat.ks file.

ciphers

Specifies the ciphers used by TLSv1.3.

sslEnabledProtocols

Specifies the SSL protocol used for communication.

If required, you can modify the SSL settings (sslProtocol and sslEnabled Protocols) to enable only TLSv1.2. When enabling TLSv1.2, ensure you remove any unsupported ciphers or use only those compatible with TLSv1.2.