Disable weak TLS 1.2 cipher suites in DPA

1/27/2026 4:29 PM

1/27/2026 4:29 PM

Starting with DPA 2025.2, Database Performance Analyzer (DPA) uses JDK 17 and Tomcat 10. By default, JDK 17 enables both TLS 1.2 and TLS 1.3 for HTTPS connections. Because TLS 1.2 can allow weaker cipher suites, you may need to restrict or disable those cipher suites to meet your organization’s security requirements or pass vulnerability scans.

Cipher suites for TLS 1.2:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 

Cipher suites for TLS 1.3:

• TLS_AKE_WITH_AES_256_GCM_SHA384
• TLS_AKE_WITH_CHACHA20_POLY1305_SHA256
• TLS_AKE_WITH_AES_128_GCM_SHA256 

Database Performance Analyzer

A security scan or compliance check reports that the DPA web server supports weak cipher suites over TLS 1.2.

• With JDK 17, TLS 1.2 and TLS 1.3 are enabled by default for SSL/TLS communication.

• TLS 1.2 still permits some weaker cipher suites that may not meet your organization’s security baseline.

• Unless Tomcat is explicitly configured to restrict cipher suites, those TLS 1.2 ciphers remain available.

You have two main options:

1. Restrict TLS 1.2 cipher suites to a strong set of ciphers using the Tomcat SSLHostConfig configuration.

2. Disable TLS 1.2 and allow only TLS 1.3, which supports only strong cipher suites and therefore does not require an explicit cipher list.

Before you begin

• Locate the DPA Tomcat configuration file:

  <DPA-install-directory>/tomcat/conf/server.xml
  

• Make a backup of server.xml before editing it.

• Changes take effect only after restarting the DPA service (Tomcat).

Option 1 – Restrict TLS 1.2 cipher suites in server.xml

Use this option if you must keep TLS 1.2 enabled for compatibility but want to disable weaker cipher suites.

1. Back up the Tomcat configuration file.

   • Copy <DPA-install-directory>/tomcat/conf/server.xml to a safe location.

2. Open server.xml in a text editor with appropriate permissions.

3. Locate the HTTPS connector used by DPA (port 8124 by default). It will look similar to:

   <Connector port="8124"
              maxHttpHeaderSize="20480"
              URIEncoding="UTF-8"
              scheme="https"
              secure="true"
              SSLEnabled="true"
              compression="on"
              compressionMinSize="2048"
              compressibleMimeType="text/html,text/xml,text/csv,text/css,application/javascript"
              defaultSSLHostConfigName="dpasslhost">
       ...
   </Connector>

4. Add or update the SSLHostConfig block to restrict cipher suites.

   For example:

   <Connector port="8124"
              maxHttpHeaderSize="20480"
              URIEncoding="UTF-8"
              scheme="https"
              secure="true"
              SSLEnabled="true"
              compression="on"
              compressionMinSize="2048"
              compressibleMimeType="text/html,text/xml,text/csv,text/css,application/javascript"
              defaultSSLHostConfigName="dpasslhost">
       <SSLHostConfig hostName="dpasslhost"
                      honorCipherOrder="true"
                      protocols="TLSv1.2+TLSv1.3"
                      ciphers="HIGH:!SHA1:!SHA256:!SHA384:!RSA:!DHE">
           <Certificate certificateKeystoreFile="conf/.keystore"
                        certificateKeystoreType="PKCS12"
                        type="RSA" />
       </SSLHostConfig>
   </Connector>

   • protocols="TLSv1.2+TLSv1.3" keeps both TLS 1.2 and TLS 1.3 enabled.

   • The ciphers expression restricts the configuration to high-security cipher suites only, excluding ciphers that use SHA1, SHA256, SHA384, RSA key exchange, or DHE as specified in the expression.

   Note: The exact ciphers string you use should be aligned with your organization’s security policy and the cipher suites supported by your clients and security tools.

5. (Alternative) Specify an explicit cipher list

   Instead of using an OpenSSL-style cipher expression, you can configure an explicit, comma-separated list of allowed cipher suites, for example:

   ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
            TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
   

   • Use cipher suites that are:

     • Supported by your deployed JDK/Tomcat version.

     • Accepted by your security standards and client applications.

6. Save server.xml.

7. Restart the DPA service (Tomcat).

   • On Windows, restart the SolarWinds DPA service.

   • On Linux, restart the service or script used to run DPA.

8. Re-run your security scan to confirm that the weaker TLS 1.2 cipher suites are no longer offered.

Option 2 – Enable only TLS 1.3

If all clients that connect to the DPA web console support TLS 1.3, you can simplify configuration by disabling TLS 1.2 entirely and allowing only TLS 1.3.

1. Back up server.xml.

2. Open server.xml and locate the HTTPS connector (as shown above).

3. Update the SSLHostConfig block so that it enables only TLS 1.3 and omits the ciphers attribute:

   <Connector port="8124"
              maxHttpHeaderSize="20480"
              URIEncoding="UTF-8"
              scheme="https"
              secure="true"
              SSLEnabled="true"
              compression="on"
              compressionMinSize="2048"
              compressibleMimeType="text/html,text/xml,text/csv,text/css,application/javascript"
              defaultSSLHostConfigName="dpasslhost">
       <SSLHostConfig hostName="dpasslhost"
                      protocols="TLSv1.3">
           <Certificate certificateKeystoreFile="conf/.keystore"
                        certificateKeystoreType="PKCS12"
                        type="RSA" />
       </SSLHostConfig>
   </Connector>
   

   • TLS 1.3 only supports strong cipher suites, so there is no need to define an explicit cipher list in the SSLHostConfig block.

4. Save server.xml.

5. Restart the DPA service (Tomcat).

6. Verify that only TLS 1.3 is offered:

   • Use your security scanning tool, or

   • Use an SSL/TLS testing tool (for example, openssl s_client or browser-based scanners) to confirm that TLS 1.2 is disabled and only TLS 1.3 is negotiated.

Important: If you restrict the server to TLS 1.3 only, older clients that do not support TLS 1.3 will no longer be able to connect to the DPA web console.

For more information see DPA Secure Configuration Guide: Best Practices and Recommendations