1.9 Rejecting Client-initiated SSL Renegotiation on Windows

Under certain circumstances, Identity Manager can be susceptible to a Denial of Service attack caused by a client initiated SSL renegotiation operation. To configure Identity Manager to reject this operation, perform the following actions on each computer running the identity applications:

  1. Edit the tomcat-install-directory>\bin\setenv.bat file.

  2. Add the following flag to the CATALINA_OPTS entry in the file:

    "-Djdk.tls.rejectClientInitiatedRenegotiation=true"

  3. Save the setenv.bat file.

  4. Restart Tomcat.