Chapter 7. Disabling TLS 1.0 and TLS 1.1 Encryption

Procedure

1. Open the /etc/foreman-installer/custom-hiera.yaml file for editing:

   # vi /etc/foreman-installer/custom-hiera.yaml

   Copy to Clipboard Toggle word wrap

2. Add the following entries:

   # Apache
   apache::mod::ssl::ssl_protocol: [ 'ALL' , '-SSLv3' , '-TLSv1' , '-TLSv1.1' , '+TLSv1.2' ]
   
   # QPID Dispatch
   foreman_proxy_content::qpid_router_ssl_ciphers: 'ALL:!aNULL:+HIGH:-SSLv3:!IDEA-CBC-SHA'

   Copy to Clipboard Toggle word wrap

3. Enter the satellite-installer command to apply the above configuration and configure Qpid to use TLS 1.2 only:

   # satellite-installer \
   --foreman-proxy-content-qpid-router-ssl-protocols=TLSv1.2

   Copy to Clipboard Toggle word wrap