To Choose the List of Ciphers and Protocols

Use this procedure to retrieve the supported ciphers and protocols, and the enabled ciphers and protocols. If a cipher or protocol is supported, you can enable or disable it.

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. View the list of supported ciphers and protocols.

   $ dpconf get-server-prop -h host -p port supported-ssl-cipher-suites \ supported-ssl-protocols

2. View the list of enabled ciphers and protocols.

   $ dpconf get-server-prop -h host -p port enabled-ssl-cipher-suites \ enabled-ssl-protocols

3. Enable one or more supported ciphers or protocols.

   1. Enable one or more supported ciphers.

      $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-suites:supported-ssl-cipher-suite \ [enabled-ssl-cipher-suites:supported-ssl-cipher-suite ...]

      To add a cipher to an existing list of supported ciphers, use this command:

      $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-suites+:supported-ssl-cipher-suite

   2. Enable one or more supported protocols.

      $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-protocols:supported-ssl-cipher-protocol \ [enabled-ssl-cipher-protocols:supported-ssl-cipher-protocol ...]

      To add a protocol to an existing list of supported protocols, use this command:

      $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-protocols+:supported-ssl-cipher-protocol

4. (Optional) Disable a supported cipher or protocol.

   $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-protocols-:supported-ssl-cipher-protocol