Wowza SSL/TLS Security Settings - Revision history

IVSWikiBlue at 15:27, 26 June 2020

2020-06-26T15:27:34Z

← Older revision		Revision as of 15:27, 26 June 2020
Line 4:		Line 4:
	# Change the line to:<pre><Protocols>TLSv1.2</Protocols></pre>		# Change the line to:<pre><Protocols>TLSv1.2</Protocols></pre>
	# Locate the line in the file under the SSL section (it should be right above the protocols line) <pre><CipherSuites></CipherSuites></pre>		# Locate the line in the file under the SSL section (it should be right above the protocols line) <pre><CipherSuites></CipherSuites></pre>
	# Change the line to:<pre><CipherSuites>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</CipherSuites></pre>		# Change the line to: <pre><CipherSuites>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</CipherSuites></pre>
	# Type '''CTRL-X''' and then press Enter to exit.		# Type '''CTRL-X''' and then press Enter to exit.
	# Enter '''Y''' to save changes.		# Enter '''Y''' to save changes.

IVSWikiBlue at 15:19, 26 June 2020

2020-06-26T15:19:29Z

← Older revision		Revision as of 15:19, 26 June 2020
Line 1:		Line 1:
	~~Wowza~~, ~~disable TLS 1.0~~ and ~~explicitly allow v1~~.~~1 and v1~~.2		# Connect to the server via ssh or access the shell via the console.
	~~In Vhost.xml~~ file, <~~Protocols~~>~~TLSv1~~.1,~~TLSv1.2~~</~~Protocols~~>		# Type in the following, and then press Enter: <pre>sudo nano /usr/local/WowzaStreamingEngine/conf/VHost.xml</pre>
			# Locate the line in the file under the SSL section (approximately line 83) <pre><Protocols></Protocols></pre>
			# Change the line to:<pre><Protocols>TLSv1.2</Protocols></pre>
			# Locate the line in the file under the SSL section (it should be right above the protocols line) <pre><CipherSuites></CipherSuites></pre>
			# Change the line to:<pre><CipherSuites>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</CipherSuites></pre>
			# Type '''CTRL-X''' and then press Enter to exit.
			# Enter '''Y''' to save changes.
			# Do not change the name and press Enter to save the changes.
			# Type in the following, and then press Enter: <pre>sudo service WowzaStreamingEngine restart</pre>

			You can verify the active ciphers by running the following command:

	~~Cipher Suites:~~		<pre>nmap -sV --script ssl-enum-ciphers -p 444 <host></pre>
	~~https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment~~-~~Best~~-~~Practices#23~~-~~use~~-~~secure~~-~~cipher~~-~~suites~~
	<~~CipherSuites~~>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</~~CipherSuites~~>

IVSWikiBlue: Created page with "Wowza, disable TLS 1.0 and explicitly allow v1.1 and v1.2 In Vhost.xml file, TLSv1.1,TLSv1.2 Cipher Suites: https://github.com/ssllabs/research/wiki/S..."

2020-06-26T15:09:28Z

Created page with "Wowza, disable TLS 1.0 and explicitly allow v1.1 and v1.2 In Vhost.xml file, <Protocols>TLSv1.1,TLSv1.2</Protocols> Cipher Suites: https://github.com/ssllabs/research/wiki/S..."

New page

Wowza, disable TLS 1.0 and explicitly allow v1.1 and v1.2
In Vhost.xml file, <Protocols>TLSv1.1,TLSv1.2</Protocols>

Cipher Suites:
https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites
<CipherSuites>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</CipherSuites>