Disable SSLv3 in PingFederate

If you are running PingFederate 7.X or older you have SSLv3 enabled. Since SSLv3 is considered insecure I wanted to remove it from our PingFederate systems.

You disable SSLv3 pretty easy by changing the following configuration file:

$INSTALLDIR/pingfederate/etc/jetty-runtime.xml

Search for a line which looks like this:

<New class="com.pingidentity.appserver.jetty.server.connector.ssl.RuntimeSslContextFactory"></New>

It should like this instead:

<New class="com.pingidentity.appserver.jetty.server.connector.ssl.RuntimeSslContextFactory">
                <Set name="includeProtocols">
                <Array type="java.lang.String">
                <Item>TLSv1</Item>
                <Item>TLSv1.1</Item>
                <Item>TLSv1.2</Item>
                </Array>
                </Set>

PingFederate 8 and newer have SSLv3 disabled by default.

Disable Secure Client-Initiated Renegotiation in PingAccess

If you have a system running PingAccess you have maybe notices when scanning the system with ssllabs scanner that it supports Secure Client-Initiated Renegotiation which is not good in a security point of view.

So how do you disable it? Well, since PingAccess is a Java application it simple relies on Java do disable it. The easiest way to disable it is in the run.sh or run.bat:

"$JAVA" -classpath "$CLASSPATH" $JAVA_OPTS \
        -Djavax.net.ssl.sessionCacheSize=5000 \
        -Djava.net.preferIPv4Addresses=true \
        -Djava.net.preferIPv4Stack=true \
        -Djava.net.preferIPv6Addresses=false \
        -Djava.awt.headless=true \
        -Djdk.tls.rejectClientInitiatedRenegotiation=true \
        -Dpa.jwk="$pajwk" \
        -Dblitz4j.configuration="$BLITZ_PROPS" \
        -Drun.properties="$runprops" \
        -Dbootstrap.properties="$bootprops" \
        -Dpa.home="$PA_HOME" \
                com.pingidentity.pa.cli.Starter "$@"
 
By adding that little tls.reject line you have disabled Secure Client-Initiated Renogoation in PingAccess.