Administer > Security Configuration > Strengthen Security > Configure the Ciphers Used by the NNMi Web Server

Configure the Ciphers Used by the NNMi Web Server

NNMi supports the following ciphers for secure communications with the NNMi web server.

  • TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  • TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
  • TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  • TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
  • TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  • TLS_DHE_DSS_WITH_AES_256_CBC_SHA
  • TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  • TLS_DHE_DSS_WITH_AES_128_CBC_SHA
  • TLS_RSA_WITH_AES_256_CBC_SHA256
  • TLS_RSA_WITH_AES_128_CBC_SHA256
  • TLS_RSA_WITH_AES_128_CBC_SHA
  • TLS_RSA_WITH_AES_256_CBC_SHA

To change the list of protocols that NNMi can use, uncomment and configure the com.hp.ov.nms.ssl.CIPHERS parameter in the following file:

  • Windows:

    %NnmDataDir%\shared\<PRODUCT>\conf\props\nms-jboss.properties

  • Linux:

    var/opt/OV/shared/<PRODUCT>/conf/props/nms-jboss.properties

This parameter contains an ordered list of one or more ciphers. If NNMi is unable to use the first cipher in the list to establish a connection between the NNMi web server and the user's web browser, NNMi tries to use the next cipher, and so forth. (The preceding list shows the default cipher ordering.)

You can edit the value of the com.hp.ov.nms.ssl.CIPHERS parameter to delete ciphers that NNMi should not use and to change the order in which NNMi attempts to use the available ciphers.

If you change the list of supported ciphers,  recommends ordering the ciphers list in order of strength. That is, place 256-bit encryption above 128-bit encryption.

Note  

  • The value of the com.hp.ov.nms.ssl.CIPHERS parameter must be a comma-separated list that contains no white space and is one contiguous line.
  • Save the cipher list before changing it. Removing ciphers from the com.hp.ov.nms.ssl.CIPHERS list can prevent NNMi from starting.
  • The web browser must support at least one of the configured ciphers.

  • In a GNM environment, modify the file on one NNMi management server, and then copy the revised file to the other NNMi management servers in the GNM environment. After the file is in place on all NNMi management servers, restart all NNMi management servers.

    In a high availability environment, modify the file on the active NNMi management server only.

Send Help Center feedback