Endpoint Protection

 View Only
  • 1.  TLS enable or not

    Posted Aug 15, 2018 12:28 AM
      |   view attached

    Guys,

    Through this information, is it possible to say that TLS is enabled or not?

    If it is not possible, by the console where I see if it is enabled or not? Or where I check this information.



  • 2.  RE: TLS enable or not
    Best Answer

    Posted Aug 15, 2018 07:03 AM

    The ssl.conf file only sets the parameters for how TLS would be used (for report access) if it were enabled, not whether or not it actually is used or enabled.

    To verify if the SSL bits are even enabled, you need to look for the section starting <IfModule ssl_module> in the httpd.conf under "X:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf".

    Specifically for client communications, you need to ensure that "Include conf/ssl/sslForClients.conf" is present and has not been hashed out.  This means that the SEPM is listening for secure comms.

    You then need to check your MSL (in the SEPM Console, under Policies -> Policy Components -> Management Server Lists) to see if your SEP clients are being told to use it.

    ************************************************************

    If you're asking specifically about TLS however, then the line "SSLProtocol all -SSLv2 -SSLv3" means all SSL and TLS protocols are enabled, except SSLv2 and SSLv3.  This means that TLSv1.0, v1.1 and v1.2 remain enabled.

    Just for completeness of information, you can follow the below article to disable TLSv1 and v1.1 as well if you want:

    https://www.symantec.com/docs/TECH235995