excludeProtocols - includeProtocols - allowCiphers - denyCiphers config file
The following
configuration is recommended for systems running 7.0.0.63, and higher.
(For older 6.5 releases of UW, please see this
article.)
/stoneware/config/excludeProtocols
TLSv1
TLSv1.1
# Uncomment the following line, to also disable TLS 1.2
#TLSv1.2
SSL
SSLv2
SSLv2Hello
SSLv3
/stoneware/config/includeProtocols - leave this file empty
/stoneware/config/allowCiphers
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_SHA256
TLS_ECDHE_RSA_WITH_AES_128_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_SHA
TLS_ECDHE_RSA_WITH_AES_256_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_SHA384
TLS_ECDHE_RSA_WITH_AES_256_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_SHA
TLS_DHE_RSA_WITH_AES_128_SHA256
TLS_DHE_RSA_WITH_AES_128_SHA
TLS_DHE_DSS_WITH_AES_128_SHA256
TLS_DHE_RSA_WITH_AES_256_SHA256
TLS_DHE_DSS_WITH_AES_256_SHA
TLS_DHE_RSA_WITH_AES_256_SHA
#TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
#TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
/stoneware/config/denyCiphers
.*NULL.*
.*RC4.*
.*MD5.*
.*DES.*
.*DSS.*
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Any changes to these files requires webNetwork to be shut down and started back up.