如何在LBL ADC中的单个虚拟主机上禁用TLS 1.0(不带GUI的版本)

Question

我需要在单个虚拟主机上禁用TLS 1.0，LBL的版本较旧(版本9(。我该怎么做？

谢谢，洛伦佐

Answer 1

在OPLON LBL应用程序交付控制器中，您可以为所有侦听器或单个侦听器启用和禁用SSL/TLS协议和密码套件。

低于单个侦听器的参数。如果设置了，则单个侦听器的参数将覆盖常规参数。

参数：SSLProtocols="TLSv1.1 TLSv1.2">

<bind enable="true"
description="Sample HTTPS listener"
listenType="NAT"
address="192.168.56.17 192.168.178.70"
port="443"
SSL="true"
SSLSNI="false"
SSLSNIDefaultCertificateEnable="false"
SSLContextVersion="SSLv3"
SSLUseCipherSuitesOrder="true"
aliasPassword="defaultpwd"
certificateURIPath="serverkeys"
certificateURL=""
checkClientCertificateValidity="false"
SSLProtocols="TLSv1.1 TLSv1.2"
cipherSuites="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_SHA256 TLS_ECDHE_RSA_WITH_AES_128_SHA TLS_ECDHE_ECDSA_WITH_AES_128_SHA TLS_ECDHE_RSA_WITH_AES_256_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_SHA384 TLS_ECDHE_RSA_WITH_AES_256_SHA TLS_ECDHE_ECDSA_WITH_AES_256_SHA TLS_DHE_RSA_WITH_AES_128_SHA256 TLS_DHE_RSA_WITH_AES_128_SHA TLS_DHE_DSS_WITH_AES_128_SHA256 TLS_DHE_RSA_WITH_AES_256_SHA256 TLS_DHE_DSS_WITH_AES_256_SHA"
enableVirtualDomain="true"
endPointsGrouping="http_https"
forwardClientCertificateChainDepth="1"
forwardClientCertificateToEndpoint="false"
forwardClientPemCertificateToEndpoint="false"
keyStore="JKS"
keyManagerFactory="SunX509"
keyStorePassword="defaultpwd"
needClientAuthentication="true"
osiLayer="7"
portForwarding="false"
sslSessionCacheSize="0"
sslSessionCacheTimeout="86400"
transport="tcp"
trustAllCertificates="true"
trustCertificateURIPath="trustStore.jks"
trustKeyStore="JKS"
trustKeyStorePassword="test"
xForwardedFor="true"/>

在这一段中，所有听众的参数是：

参数：SSLProtocolsListeners="TLSv1.1 TLSv1.2">

<params 
SSLProtocolsListeners="TLSv1.1 TLSv1.2"
cipherSuitesListeners="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_SHA256 TLS_ECDHE_RSA_WITH_AES_128_SHA TLS_ECDHE_ECDSA_WITH_AES_128_SHA TLS_ECDHE_RSA_WITH_AES_256_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_SHA384 TLS_ECDHE_RSA_WITH_AES_256_SHA TLS_ECDHE_ECDSA_WITH_AES_256_SHA TLS_DHE_RSA_WITH_AES_128_SHA256 TLS_DHE_RSA_WITH_AES_128_SHA TLS_DHE_DSS_WITH_AES_128_SHA256 TLS_DHE_RSA_WITH_AES_256_SHA256 TLS_DHE_DSS_WITH_AES_256_SHA"
clientH2Bridge="false"
clientSSLUseCipherSuitesOrder="true"
concurrentSessions="-1"
dosAttackPrevention="false"
dosAttackPreventionOnlyClose="false"
endPointSSLUseCipherSuitesOrder="true"
maxConcurrentSessions="-1">
</params>