Choosing SSL Ciphers and SSL Protocols for Directory Proxy Server

The ciphers and protocols that can be used by Directory Proxy Server depend on the Java Virtual Machine (JVM) that is being used. By default, Directory Proxy Server uses the default ciphers and protocols that are enabled for the JVM machine.

To Choose the List of Ciphers and Protocols

Use this procedure to retrieve the supported ciphers and protocols, and the enabled ciphers and protocols. If a cipher or protocol is supported, you can enable or disable it.

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. View the list of supported ciphers and protocols.

   $ dpconf get-server-prop -h host -p port supported-ssl-cipher-suites \
    supported-ssl-protocols

2. View the list of enabled ciphers and protocols.

   $ dpconf get-server-prop -h host -p port enabled-ssl-cipher-suites \
    enabled-ssl-protocols

3. Enable one or more supported ciphers or protocols.
   1. Enable one or more supported ciphers.

      $ dpconf set-server-prop -h host -p port \
       enabled-ssl-cipher-suites:supported-ssl-cipher-suite \
       [enabled-ssl-cipher-suites:supported-ssl-cipher-suite ...]

      To add a cipher to an existing list of supported ciphers, use this command:

      $ dpconf set-server-prop -h host -p port \
       enabled-ssl-cipher-suites+:supported-ssl-cipher-suite

   2. Enable one or more supported protocols.

      $ dpconf set-server-prop -h host -p port \
       enabled-ssl-cipher-protocols:supported-ssl-cipher-protocol \
       [enabled-ssl-cipher-protocols:supported-ssl-cipher-protocol ...]

      To add a protocol to an existing list of supported protocols, use this command:

      $ dpconf set-server-prop -h host -p port \
       enabled-ssl-cipher-protocols+:supported-ssl-cipher-protocol

4. (Optional) Disable a supported cipher or protocol.

   $ dpconf set-server-prop -h host -p port \
    enabled-ssl-cipher-protocols-:supported-ssl-cipher-protocol