I have a customer with concerns about this
All Laserfiche products and components, with the exception of the Java RepositoryAccess library that ships with the SDK and usually goes by the acronym "JRA", uses the implementation of SSL/TLS that ships with Microsoft Windows, which is called SChannel. An administrator can configure which protocols and cipher suites SChannel is allowed to use via registry settings. Please see http://support.microsoft.com/kb/245030 for more details. LF products specifically disable SSL 2.0 and allow SSL 3.0 and TLS 1.0, 1.1, and 1.2. You can choose to disable support for any of these protocols or specific cipher suites for all programs that use SChannel on a machine by following the directions in KB article 245030. Please note that both ends of a secured channel must negotiate the same protocol and cipher suite for successful communication to occur.
No LF product uses JRA but if you have the SDK you can write your own Java programs which use JRA to communicate with the Laserfiche Server. JRA supports SSL/TLS through Java Secure Socket Extension (JSSE). Please consult Java's documentation on how to configure allowed protocols and cipher suites for JSSE.
The LF Client works with 3.0.
Most all web based applications, including all the common browsers, block older versions of SSL by default. I can't say for sure about the LF Client.
Hi Dina,
If your question has been answered, please let us know by clicking the "This answered my question" button on the response.
If you still need assistance with this matter, just update this thread. Thanks!
Is LF using SSL V3 by default?
Thanks in advance.
As Michael says, LFS won't use anything less than SSL 3.0, but whether that is actually used will depend on SChannel configuration. Also remember that the protocol is negotiated between the client and server, so what is selected can vary depending on the client configuration.