You are viewing limited content. For full access, please sign in.

Question

Question

Disabling Diffie Hellman and TLS1.1

asked on April 28, 2023

I have a user that wants to know if disabling Diffie Hellman and TLS1.1 will cause any issues with Laserfiche web server?

 

I have found this:

https://support.laserfiche.com/kb/1013919/configuration-information-for-tls-1-2

But I'm checking if anyone has had issues with Laserfiche web server doing it.

0 0

Answer

SELECTED ANSWER
replied on April 28, 2023 Show version history
  1. Make sure both Client and Server TLS 1.2 schannel protocols are enabled beforehand.
  2. Make sure you're on the latest supported version of Laserfiche 10.4 or 11 software. If you're on any older versions, make sure to apply all the configurations described in the TLS 1.2 config info KB article you linked.

If you're running a version of Windows Server prior to 2016, you probably don't want to disable TLS 1.1 without extensive testing of Windows functionality first. For example, disabling TLS 1.0/1.1 on a default installation of Windows Server 2012 R2 will break RDP. You then have the fun task of attempting to remotely edit the affected machine's registry to undo the change. Server 2012 R2 also hits end of life later this year.

The "disable Diffie-Hellman" request is weird, unless what they mean is "Disable cipher suites with fixed Diffie-Hellman (DH and ECDH) key exchange and only allow ephemeral Diffie-Hellman (DHE and ECDHE) instead". That's fine.

You absolutely do not want to categorically "disable Diffie-Hellman". The strongest TLS 1.2 cipher suites all use Elliptic Curve Diffie-Hellman Ephemeral key exchange (TLS_ECDHE_*). For example, see these IBMMicrosoft, and SEC.gov articles. 

0 0

Replies

replied on April 28, 2023

The user is on version 10.4

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.