Chapter 2. Configuring the supported TLS protocol versions

Procedure

1. Optional: Display the TLS protocols that are currently enabled in Directory Server:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security get | egrep -i "sslVersionMin|sslVersionMax"
   sslversionmin: TLS1.2
   sslversionmax: TLS1.3

2. Set the minimum TLS protocol. For example, to set it to TLS 1.3, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --tls-protocol-min="TLS1.3"

   Note that you cannot set the parameter to a value lower than TLS 1.2, which is the minimum of all RHEL system-wide crypto policy profiles.

3. Not recommended: Set the highest supported TLS protocol:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --tls-protocol-max="TLS1.3"

   If you set --tls-protocol-max to a value lower than in --tls-protocol-min, then Directory Server sets the maximum protocol to the same value as the minimum.

   To always use the strongest supported encryption protocol as the maximum supported TLS version, do not set --tls-protocol-max.

4. Restart the instance:

   # dsctl instance_name restart

Verification

1. Display the supported TLS protocols:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security get | egrep -i "sslVersionMin|sslVersionMax"
   sslversionmin: TLS1.3
   sslversionmax: TLS1.3

2. Use the openssl utility to establish a secure client connection using a specific TLS protocol:

   # echo | openssl s_client -connect server.example.com:636 -tls1_3
   ...
   New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
   ...

Procedure

1. Navigate to Server Security.
2. Set the minimum TLS protocol in the Minimum TLS Version field.
3. Not recommended: Set the highest supported TLS protocol in the Maximum TLS Version field.
4. Click Save Settings.
5. Click Actions in the top right corner, and select Restart Instance.