SSL Server Test: apiportal.cepsa.com

Document ID : KB000098923
Last Modified Date : 31/05/2018
Show Technical Document Details
Question:
The customer is planning to update the API Portal from version 3.5 to version 4.2.
But first, they need to know if the security vulnerabilities with TLS 1.0, various cipher suites are present in version 4.2. It is also necessary to know if these security vulnerabilities are covered with:
1. Installation and configuration out-of-the-box of the new version of the API Portal (4.2)
2. Requirements on the base architecture in which the new version of the API Portal will be installed.
Environment:
Portal 3.5/4.2
Answer:
For the Portal 3.5 Appliance SSLv2 is disabled by default in /etc/httpd/conf.d/ssl.conf via "SSLProtocol all -SSLv2". 
With the latest Appliance platform patch the SSLProtocol line can be set to "SSLProtocol TLSv1.2" which only enables TLS 1.2.
You can also customize the SSLCipherSuite. 

For Portal 4.2 Only TLSv1.2 is enabled.