Wowza SSL/TLS Security Settings: Difference between revisions
Jump to navigation
Jump to search
IVSWikiBlue (talk | contribs) Created page with "Wowza, disable TLS 1.0 and explicitly allow v1.1 and v1.2 In Vhost.xml file, <Protocols>TLSv1.1,TLSv1.2</Protocols> Cipher Suites: https://github.com/ssllabs/research/wiki/S..." |
IVSWikiBlue (talk | contribs) No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
# Connect to the server via ssh or access the shell via the console. | |||
# Type in the following, and then press Enter: <pre>sudo nano /usr/local/WowzaStreamingEngine/conf/VHost.xml</pre> | |||
# Locate the line in the file under the SSL section (approximately line 83) <pre><Protocols></Protocols></pre> | |||
# Change the line to:<pre><Protocols>TLSv1.2</Protocols></pre> | |||
# Locate the line in the file under the SSL section (it should be right above the protocols line) <pre><CipherSuites></CipherSuites></pre> | |||
# Change the line to: <pre><CipherSuites>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</CipherSuites></pre> | |||
# Type '''CTRL-X''' and then press Enter to exit. | |||
# Enter '''Y''' to save changes. | |||
# Do not change the name and press Enter to save the changes. | |||
# Type in the following, and then press Enter: <pre>sudo service WowzaStreamingEngine restart</pre> | |||
You can verify the active ciphers by running the following command: | |||
<pre>nmap -sV --script ssl-enum-ciphers -p 444 <host></pre> | |||
< | |||
Latest revision as of 15:27, 26 June 2020
- Connect to the server via ssh or access the shell via the console.
- Type in the following, and then press Enter:
sudo nano /usr/local/WowzaStreamingEngine/conf/VHost.xml
- Locate the line in the file under the SSL section (approximately line 83)
<Protocols></Protocols>
- Change the line to:
<Protocols>TLSv1.2</Protocols>
- Locate the line in the file under the SSL section (it should be right above the protocols line)
<CipherSuites></CipherSuites>
- Change the line to:
<CipherSuites>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256</CipherSuites>
- Type CTRL-X and then press Enter to exit.
- Enter Y to save changes.
- Do not change the name and press Enter to save the changes.
- Type in the following, and then press Enter:
sudo service WowzaStreamingEngine restart
You can verify the active ciphers by running the following command:
nmap -sV --script ssl-enum-ciphers -p 444 <host>