TLS on WebSphere

1.Enabling TLS-Only on WebSphere:
Transport Layer Security (TLS) protocol is an improvement on the SSL v3 protocol. This section discusses:
Configuring WebSphere for TLS.
Configuring browsers for TLS.
Testing TLS.
Configuring Reverse Proxy Servers for TLS.

2.Configuring WebSphere for TLS, Press Enter to collapse:
To enable TLS-only on WebSphere:
Login to ISC (http://host:adminport/ibm/console).
Under the Security menu, select SSL certificate and key management, SSL configurations, NodeDefaultSSLSettings, Quality of protection (QoP) settings.
Change the Protocol value to TLS orTLSv1.
This ensures that WebSphere server will accept only TLS connections. That is, when the web server acts as a server (inbound) or as client (outbound) the SSL connections will be established through the TLS protocol. When testing from a browser make sure to check the browser settings to initiate TLS handshakes only.

3.Configuring Browsers for TLS, Press Enter to collapse:
Setting Up TLS on Microsoft Internet Explorer

4.To set up TLS on Internet Explorer:
Launch Internet Explorer.
Select Tools, Internet Options, and select the Advanced tab.
In the Settings box in the Security section, disable Use SSL 3.0 and enableUse TLS 1.0.
Click OK and restart the browser.
Setting Up TLS on Mozilla Firefox

To set up TLS on Firefox:
Launch Firefox.
Select Tools, Options, click the Advanced icon, and select the Encryption tab.
In the Protocols group box, disable Use SSL 3.0 and enableUse TLS 1.0.
Click OK and restart the browser.

5.Testing TLS, Press Enter to collapse:
After setting TLS for WebSphere and browsers, the TLS communication can be verified by logging in to the PeopleSoft application through WebSphere’s default SSL port (HTTPS).
For example:
https://<host_name>:<https_port>/<PIA site>/signon.html
You can find the HTTPS port in the WebSphere Administrative Console, by selecting Servers, Application Server, server1, ports. Find the port corresponding to the entry WC_defaulthost_secure

6.Configuring Reverse Proxy Servers for TLS, Press Enter to collapse:
It is strongly recommended to that you access the vendor's documentation of the web server you are using for a reverse proxy server and use their instructions for setting up TLS.



OR 

SL certificate and key management > SSL configurations > CellDefaultSSLSettings > Quality of protection (QoP) settings

or via a Jython script: -

AdminTask.modifySSLConfig('[-alias CellDefaultSSLSettings -scopeName (cell):BAMCell1 -keyStoreName CellDefaultKeyStore -keyStoreScopeName (cell):BAMCell1 -trustStoreName CellDefaultTrustStore -trustStoreScopeName (cell):BAMCell1 -jsseProvider IBMJSSE2 -sslProtocol TLSv1.2 -clientAuthentication false -clientAuthenticationSupported false -securityLevel HIGH -enabledCiphers ]') 
AdminConfig.save()
AdminNodeManagement.syncActiveNodes()

/opt/IBM/WebSphere/AppServer/profiles/BAMCell1AppSrv01/logs/nodeagent/config/cells/BAMCell1/security.xml
and change: -

sslProtocol="SSL_TLS"

to: -

sslProtocol="TLSv1.2"

Note: To do rest ot nodes as per above to change TLS version.

/opt/IBM/WebSphere/AppServer/profiles/BAMCell1Dmgr01/config/cells/BAMCell1/security.xml


Once I made this change, and manually restarted the Node Agent, all was well, and both Deployment Manager and Node Agent were correctly using TLS 1.2.