Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls

The server initially got a score of "F", but adding SSL_DISABLE_RENEGOTIATE=1 and unchecking the old SSL Ciphers has improved the score to "B".

(I've update the following to the correct settings as per the blog post below)

To clarify the following SSL Ciphers are enabled:
- RC4 encryption with 128-bit key and MD5 MAC
- RC4 encryption with 128-bit key and SHA-1 MAC

The following SSL Ciphers are disabled:
- AES encryption with 128-bit key and SHA-1 MAC (Domino 8+ only)
- AES encryption with 256-bit key and SHA-1 MAC (Domino 8+ only)
- DES encryption with 56-bit key and SHA-1 MAC
- Triple DES encryption with 168-bit key and SHA 1 MAC
- RC4 encryption with 40-bit key and MD5 MAC
- No encryption with MD5 MAC
- No encryption with SHA-1 MAC

SSL v2 is not enabled


Can you check the Blogposting here and say which cipher you have still enabled?

  • All Ciphers are currently set as per the blog posting (I've updated the original question with this information). – Gary Wilkinson Apr 2 '13 at 13:08
  • 1
    For the BREAST Vulnerability you need to disable also the AES and Triple cipher as mentioned in the blog posting. – BastianW Apr 5 '13 at 20:45
  • Somehow missed that section, have disabled the 3 ciphers and now get 'A' grade for the server. Thanks. – Gary Wilkinson Apr 10 '13 at 14:54
  • 1
    FYI - Recent IBM Open Mic on Securing an IBM Domino Web Server www-01.ibm.com/support/docview.wss?uid=swg27038063 – Gary Wilkinson Apr 10 '13 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.