To Choose the List of Ciphers and Protocols

Use this procedure to retrieve the supported ciphers and protocols, and the enabled ciphers and protocols. If a cipher or protocol is supported, you can enable or disable it.

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. View the list of supported ciphers and protocols.

   $ dpconf get-server-prop -h host -p port supported-ssl-cipher-suites \ supported-ssl-protocols

2. View the list of enabled ciphers and protocols.

   $ dpconf get-server-prop -h host -p port enabled-ssl-cipher-suites \ enabled-ssl-protocols

3. Enable one or more supported ciphers or protocols.

   1. Enable one or more supported ciphers.

      $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-suites:supported-ssl-cipher-suite \ [enabled-ssl-cipher-suites:supported-ssl-cipher-suite ...]

   2. Enable one or more supported protocols.

      $ dpconf set-server-prop -h host -p port \ enabled-ssl-cipher-protocols:supported-ssl-cipher-protocol \ [enabled-ssl-cipher-protocols:supported-ssl-cipher-protocol ...]

4. To disable a supported cipher or protocol, use the commands in the previous two steps.

   Specify the full list of ciphers or protocols, excluding the ciphers or protocols that you want to disable.