Wiki

Scale Your Enterprise

User Tools

Site Tools

Trace: • Introduction (Admin Console) • Introduction (File Operations)
versago:versago_application_security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
versago:versago_application_security [2019/07/31 12:44]
runger 		versago:versago_application_security [2020/09/15 14:49] (current)
Line 1: Line 1:
-SSL certificates are purchased by your company. There are several companies that can provide them. The first point of contact is probably the company where your domain is registered. Major providers of SSL certificates include:+====== Application Security ======
  
-  * GoDaddy (www.godaddy.com) +The following security measures must be implemented in order to secure Versago's operation.
-  * Thawte (www.thawte.com) +
-  * Symantec (www.symantec.com) +
-  * DigiCert (www.digicert.com) +
-  * Comodo (www.comodo.com)+
  
-There are other providers as well that can be found via a web search.+===== HTTPS =====
  
-Note that there is a cost for an SSL certificate and it must be renewed yearly.+HTTPS with SSL is mandatory for Versago.
  
-====== Installing an SSL Certificate ======+The Versago website requires the use of the SSL option. In order to use this option effectively you will need to acquire an **//[[versago:ssl_certificates|SSL Certificate]]//**. This is a tool that helps ensure secure communication between the web browser and the website.
  
-The following information is copied from the following URL at GoDaddy.com. The URL is correct as of February 1, 2017.+===== URL Rewrite =====
  
-https://www.godaddy.com/help/install-ssl-certificates-16623+Download and install the **URL Rewrite** extension to IIS which is required by Versago to operate correctly.
  
-<WRAP center round info> +The extension can be downloaded from Microsoft's **//[[https://www.iis.net/downloads/microsoft/url-rewrite|IIS site]]//**
-**This information is provided as a courtesy. Any questions or concerns should be directed to your Windows IIS administrator.** +
-</WRAP>+
  
 +===== TLS Versions =====
  
-**To Install an SSL Certificate in Microsoft IIS 7 **+We recommend that protocols TLS 1.0 and 1.1 be disabled
  
-  - Click **Start**, mouse-over **Administrative Tools**, and then click **Internet Services Manager**. +<WRAP center round important 80%> 
-  - In the **Internet Information Services (IIS) Manager** window, select your server. +A server reboot is required after disabling these protocols. 
-  - Scroll to the bottom, and then double-click **Server Certificates**. +The protocols can remain active if other applications running on the Versago server require them
-  - From the **Actions** panel on the right, click **Complete Certificate Request...**. +
-  - To locate your certificate file, click **...**. +
-  - In the **Open** window, select ***.*** as your file name extension, select your certificate (it might be saved as a .txt, .cer, or .crt), and then click **Open**. +
-  - In the **Complete Certificate Request** window, enter a **Friendly name** for the certificate file, and then click **OK** \\ <WRAP center round info> +
-For Wildcard SSL certificates make sure your **Friendly Name** to matches your Common Name (i.e. *.coolexample.com).+
 </WRAP> </WRAP>
-  - In the **Internet Information Services (IIS) Manager** window, select the name of the server where you installed the certificate. 
-  - Click + beside **Sites**, select the site to secure with the SSL certificate. 
-  - In the **Actions** panel on the right, click **Bindings...**. 
-  - Click **Add...**. 
-  - In the **Add Site Binding** window: 
-  - For **Type**, select **https**. 
-  - For **IP address**, select **All Unassigned**, or the IP address of the site. 
-  - For **Port**, type **443**. 
-  - For **SSL Certificate**, select the SSL certificate you just installed, and then click **OK**. 
-  - Close the **Site Bindings** window. 
-  - Close the **Internet Information Services (IIS) Manager** window. Your SSL certificate installation is complete. 
  
-Visit your website at //**https:%%//%%**//www.coolexample.com (replacing coolexample.com with your domain name) to verify the installation. If you have problems, see Test your SSL's configuration to help diagnose issues.+<WRAP center round alert 80%> 
 +Disabling TLS 1.0 and 1.1 may create compatibility issues with Crystal reports whose DB connection is not set using the SQL Native Client 11.0. 
 +In order to resolve the issue, redefine the DB connections in Crystal reports using the SQL Native Client 11.0.
  
-<WRAP center round info> +This **//[[versago:crystal|article]]//** provides more details on how to redefine the Crystal report data source
-As a courtesy, we provide information about how to use certain third-party products, but we do not endorse or directly support third-party products and we are not responsible for the functions or reliability of such products.+
 </WRAP> </WRAP>
 +
 +The easiest way to toggle SSL protocols is by using a utility called IISCrypto.
 +
 +  - Download the **//[[https://www.nartac.com/Products/IISCrypto/Download|IIS Crypto GUI]]//** program
 +  - Run the IIS Crypto program
 +  - Click on Best Practices
 +  - Deselect TLS 1.0 and 1.1 for both Server and Client protocols
 +  - Click Apply
 +  - Reboot server
 +
 +{{ :versago:app_security03.png?600 |}}
 +
 +
 +----
 +
 +
 +Follow these step to **manually** disable the protocols:
 +
 +  - Open the registry editor
 +  - Navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
 +  - Set the DisabledByDefault entry DWORD value to 1
 +  - Set the Enabled entry DWORD value to 0
 +  - Navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
 +  - Set the DisabledByDefault entry DWORD value to 1
 +  - Set the Enabled entry DWORD value to 0
 +  - Repeat for TLS 1.1
 +  - Reboot server
 +
 +{{ :versago:app_security01.png?600 |}}
 +
 +===== Require Server Name Indication =====
 +
 +Define a host name and set 'Require Server name Indication' in the bindings settings for the Versago site.
 +
 +  - Open IIS Manager
 +  - Select the Versago Site on the left pane
 +  - Go to the Actions pane to the right and select and edit Bindings
 +  - set Hostname to your site's name and select Require Server Name Indication as shown below
 +
 +{{ :versago:app_security02.png?600 |}}
 +
  
versago/versago_application_security.1564591486.txt.gz · Last modified: 2019/07/31 12:44 by runger

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial 4.0 International
CC Attribution-Noncommercial 4.0 International Valid HTML5 Valid CSS Driven by DokuWiki