topic alfresco CE 5.0.b - vti server jetty ( sharepoint) disable sslv3 in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-5-0-b-vti-server-jetty-sharepoint-disable-sslv3/m-p/280973#M234103 <HTML><HEAD></HEAD><BODY><SPAN>hi ..</SPAN><BR /><BR /><SPAN>env:</SPAN><BR /><BR /><SPAN>os = centos 6.5</SPAN><BR /><SPAN>alfresco = 5.0.b</SPAN><BR /><SPAN>vti server (jetty ) sharepoint = running in https port 7070</SPAN><BR /><BR /><BR /><BR /><SPAN>do any one know how to disable sslv3 (&nbsp; POODLE SSLv3 Protocol CBC ciphers Information Disclosure Vulnerability ) on vti server ( jetty ). currently running on https .</SPAN><BR /><BR /><BR /><SPAN>Vulnerability scanner detect as below , any solution to fix this . tq</SPAN><BR /><BR /><SPAN>1. POODLE SSLv3 Protocol CBC ciphers Information Disclosure Vulnerability&nbsp; –&gt; CVE: &nbsp;&nbsp;&nbsp;CVE-2014-3566</SPAN><BR /><SPAN>2. Missing Secure Attribute SSL Cookie Information Disclosure Vulnerability –&gt; Workaround: Set the 'secure' attribute for any cookies that are sent over an SSL connection. how to set ?</SPAN><BR /><BR /><SPAN>3. Check for SSL Weak Ciphers –&gt; how to change to strong ssl ciphers</SPAN><BR /><SPAN>Weak ciphers offered by this service:</SPAN><BR /><SPAN>&nbsp; SSL3_RSA_RC4_128_MD5</SPAN><BR /><SPAN>&nbsp; SSL3_RSA_RC4_128_SHA</SPAN><BR /><SPAN>&nbsp; SSL3_ECDHE_RSA_WITH_RC4_128_SHA</SPAN><BR /><SPAN>&nbsp; TLS1_RSA_RC4_128_MD5</SPAN><BR /><SPAN>&nbsp; TLS1_RSA_RC4_128_SHA</SPAN><BR /><SPAN>&nbsp; TLS1_ECDHE_RSA_WITH_RC4_128_SHA</SPAN><BR /><BR /><SPAN>4. Missing httpOnly Cookie Attribute –&gt;solution, Set the 'httpOnly' attribute for any session cookies. how?</SPAN><BR /><BR /><SPAN>hope some one able to help</SPAN><BR /><BR /><SPAN>tq ..</SPAN></BODY></HTML> Tue, 16 Dec 2014 07:43:21 GMT csyeow 2014-12-16T07:43:21Z alfresco CE 5.0.b - vti server jetty ( sharepoint) disable sslv3 https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-5-0-b-vti-server-jetty-sharepoint-disable-sslv3/m-p/280973#M234103 hi ..env<IMG id="smileysurprised" class="emoticon emoticon-smileysurprised" src="https://migration33.stage.lithium.com/i/smilies/16x16_smiley-surprised.png" alt="Smiley Surprised" title="Smiley Surprised" />s = centos 6.5alfresco = 5.0.bvti server (jetty ) sharepoint = running in https port 7070do any one know how to disable sslv3 (&nbsp; POODLE SSLv3 Protocol CBC ciphers Information Disclosure Vulnerability ) on vti server ( jetty ). currently running on https .Vulnerability scanner detect as bel Tue, 16 Dec 2014 07:43:21 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-5-0-b-vti-server-jetty-sharepoint-disable-sslv3/m-p/280973#M234103 csyeow 2014-12-16T07:43:21Z Re: alfresco CE 5.0.b - vti server jetty ( sharepoint) disable sslv3 https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-5-0-b-vti-server-jetty-sharepoint-disable-sslv3/m-p/280974#M234104 <HTML><HEAD></HEAD><BODY><SPAN>hi any one know how to add excludeCipherSuites &amp; protocol–Default value is&nbsp; "TLS" ( vti.server.xxx in alfresco-global.properties )</SPAN><BR /><BR /><SPAN>i find the guide </SPAN><A href="https://wiki.eclipse.org/Jetty/Howto/Configure_SSL" rel="nofollow noopener noreferrer">https://wiki.eclipse.org/Jetty/Howto/Configure_SSL</A><BR /><BR /><SPAN>hope some one can help/ advise on this issue..</SPAN><BR /><BR /><SPAN>tq</SPAN><BR /><BR /><BR /><BR /></BODY></HTML> Wed, 17 Dec 2014 09:38:45 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-5-0-b-vti-server-jetty-sharepoint-disable-sslv3/m-p/280974#M234104 csyeow 2014-12-17T09:38:45Z