← Back to IBM WebSphere Traditional V9.x Security Technical Implementation Guide

V-255829

CAT II (Medium)

The WebSphere Application Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.

Rule ID

SV-255829r960759_rule

STIG

IBM WebSphere Traditional V9.x Security Technical Implementation Guide

Version

V2R1

CCIs

CCI-000068

Discussion

Quality of Protection specifies the security level, ciphers, and mutual authentication settings for the Secure Socket Layer (SSL/TLS) configuration.

Check Content

From the administrative console, navigate to Security >> SSL certificate and key management.

Click "SSL configurations".

Click on each SSL configuration to review.

Under "Additional Properties", click "Quality of protection (QoP)" settings.

If the "Protocol" field does not show "TLSv1.2 or greater", this is a finding.

Fix Text

From the administrative console, navigate to Security >> SSL certificate and key management.

Click "SSL configurations".

Click on each SSL configuration.

Under "Additional Properties", click "Quality of protection (QoP)" settings.

At the "Protocol" pull-down menu, select "TLSv1.2 or greater".

Click "OK".

Click "Save".

Restart the DMGR and all the JVMs.