TLS Check
The TLS Check verifies that the Java security configuration for TLS only allows algorithms that are considered secure. This check is based on Mozilla’s recommendations.
Insecure algorithms in TLS cipher suites are problematic because they compromise the confidentiality and integrity of the transmitted data. Attackers can exploit known cryptographic weaknesses to decrypt or manipulate encrypted communications.
Configuring the Check
The Parameter ` mozillaTlsRecommendationType ` can be used to configure how strictly the check enforces allowed algorithms.
The following profiles are available: modern, intermediate, and old.
By default, ` intermediate ` is configured.
| Profile | Description |
|---|---|
|
Only the latest algorithms, cipher suites, and TLS 1.3 are allowed. These may not be supported by all applications and clients. |
|
Algorithms and cipher suites that are considered secure and supported by most applications and clients are allowed. |
|
Algorithms and cipher suites that are compatible with older applications and clients but may no longer be considered completely secure are also permitted. Use of this profile is not recommended. |
The setting can be adjusted in the configuration file <BPC-INSTALL-DIR>/karaf/etc/de.virtimo.bpc.core.security.checks.cfg.
Here, you can modify the line accordingly:
<BPC-INSTALL-DIR>/karaf/etc/de.virtimo.bpc.core.security.checks.cfg# TlsCheck Configuration
mozillaTlsRecommendationType=intermediateSecurity Configuration Procedure
In a fresh installation, the BPC is already configured to comply with the profile intermediate.
Individual cipher suites and TLS algorithms can be disabled in the file custom.java.security located in the BPC installation directory.
The algorithms flagged as problematic in the check results must be entered here.
Further information can be found in the Java Security Settings.
