Applications Systems

Disable SSLv3 on VMAN

This article provides steps on how to disable SSLv3 on VMAN. Use this procedure in order to reduce the number of devices in your environment that uses SSLv3 and would like to disable SSLv3 on VMAN.

First published date

10/16/2018 5:39 PM

Last published date

5/6/2019 1:57 PM

Overview

This article provides steps on how to disable SSLv3 on the VMAN website. Use this procedure in order to reduce the number of devices in your environment that uses SSLv3 and would like to disable SSLv3 on VMAN.

Product section

Virtualization Manager

Resolution

Tomcat (VMan UI):

Note: Virtual Appliance uses Tomcat and lighttpd
 

  1. Edit the /usr/share/tomcat/conf/server.xml file nd find the line which reads sslProtocol="TLS".
  2. Insert the following string to a new line underneath:
    sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"
  3. Save the file.
     

lighttpd (VMan Management Console):
Note: It is not possible to turn off the SSLv3 support for this version of lighttpd. It is possible to disable the vulnerable CBC mode of SSLv3 though:
 

  1. Open the /opt/vmware/etc/lighttpd/lighttpd.conf file.
  2. Replace the cipher list at the end of the file with the following list:
    ssl.cipher-list = "TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!KRB5-DES-CBC3-MD5:!KRB5-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!EDH-DSS-DES-CBC3-SHA:!DES-CBC3-SHA:!AES128-SHA:!AES256-SHA:!aNULL:!eNULL"
  3. Save the file.