Wiki

Scale Your Enterprise

User Tools

Site Tools

Trace: • Introduction (File Operations) • Introduction (Admin Console) • Introduction (Database Connections)
versago:versago_application_security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
versago:versago_application_security [2020/09/01 10:27]
dlee Versago 2.5 		versago:versago_application_security [2020/09/15 14:49] (current)
Line 1: Line 1:
-====== SSL Certificates ======+====== Application Security ======
  
-SSL certificates are purchased by your company. There are several companies that can provide them. The first point of contact is probably the company where your domain is registered. Major providers of SSL certificates include:+The following security measures must be implemented in order to secure Versago's operation.
  
-  * GoDaddy (www.godaddy.com) +===== HTTPS =====
-  * Thawte (www.thawte.com) +
-  * Symantec (www.symantec.com) +
-  * DigiCert (www.digicert.com) +
-  * Comodo (www.comodo.com)+
  
-There are other providers as well that can be found via a web search.+HTTPS with SSL is mandatory for Versago.
  
-Note that there is a cost for an SSL certificate and it must be renewed yearly.+The Versago website requires the use of the SSL option. In order to use this option effectively you will need to acquire an **//[[versago:ssl_certificates|SSL Certificate]]//**. This is a tool that helps ensure secure communication between the web browser and the website.
  
-====== Installing an SSL Certificate ======+===== URL Rewrite =====
  
-The following information is copied from the following URL at GoDaddy.com. The URL is correct as of February 1, 2017.+Download and install the **URL Rewrite** extension to IIS which is required by Versago to operate correctly.
  
-https://www.godaddy.com/help/install-ssl-certificates-16623+The extension can be downloaded from Microsoft's **//[[https://www.iis.net/downloads/microsoft/url-rewrite|IIS site]]//**
  
 +===== TLS Versions =====
  
-**To Install an SSL Certificate in Microsoft IIS 7 **+We recommend that protocols TLS 1.0 and 1.1 be disabled
  
-  - Click **Start**, mouse-over **Administrative Tools**, and then click **Internet Services Manager**. +<WRAP center round important 80%> 
-  - In the **Internet Information Services (IIS) Manager** window, select your server. +A server reboot is required after disabling these protocols. 
-  - Scroll to the bottom, and then double-click **Server Certificates**. +The protocols can remain active if other applications running on the Versago server require them
-  - From the **Actions** panel on the right, click **Complete Certificate Request...**. +
-  - To locate your certificate file, click **...**. +
-  - In the **Open** window, select ***.*** as your file name extension, select your certificate (it might be saved as a .txt, .cer, or .crt), and then click **Open**. +
-  - In the **Complete Certificate Request** window, enter a **Friendly name** for the certificate file, and then click **OK** \\ \\ <WRAP center round info 80%> +
-For Wildcard SSL certificates make sure your **Friendly Name** to matches your Common Name (i.e. *.coolexample.com).+
 </WRAP> </WRAP>
-  - In the **Internet Information Services (IIS) Manager** window, select the name of the server where you installed the certificate. 
-  - Click + beside **Sites**, select the site to secure with the SSL certificate. 
-  - In the **Actions** panel on the right, click **Bindings...**. 
-  - Click **Add...**. 
-  - In the **Add Site Binding** window: 
-  - For **Type**, select **https**. 
-  - For **IP address**, select **All Unassigned**, or the IP address of the site. 
-  - For **Port**, type **443**. 
-  - For **SSL Certificate**, select the SSL certificate you just installed, and then click **OK**. 
-  - Close the **Site Bindings** window. 
-  - Close the **Internet Information Services (IIS) Manager** window. Your SSL certificate installation is complete. 
  
-Visit your website at //**https:%%//%%**//www.coolexample.com (replacing coolexample.com with your domain name) to verify the installation. If you have problems, see Test your SSL's configuration to help diagnose issues.+<WRAP center round alert 80%> 
 +Disabling TLS 1.0 and 1.1 may create compatibility issues with Crystal reports whose DB connection is not set using the SQL Native Client 11.0. 
 +In order to resolve the issue, redefine the DB connections in Crystal reports using the SQL Native Client 11.0.
  
-<WRAP center round info 80%> +This **//[[versago:crystal|article]]//** provides more details on how to redefine the Crystal report data source
-As a courtesy, we provide information about how to use certain third-party products, but we do not endorse or directly support third-party products and we are not responsible for the functions or reliability of such products.+
 </WRAP> </WRAP>
  
-====== Creating a Self-Signed SSL Certificate ======+The easiest way to toggle SSL protocols is by using a utility called IISCrypto.
  
-<WRAP center round important 80%> +  - Download the **//[[https://www.nartac.com/Products/IISCrypto/Download|IIS Crypto GUI]]//** program 
-The use of a certificate issued by a proper authority is highly recommended. Self-sign certificates will cause an unsecured connection warning by browsers.  +  - Run the IIS Crypto program 
-</WRAP>+  - Click on Best Practices 
 +  - Deselect TLS 1.0 and 1.1 for both Server and Client protocols 
 +  - Click Apply 
 +  - Reboot server 
 + 
 +{{ :versago:app_security03.png?600 |}} 
 + 
 + 
 +---- 
 + 
 + 
 +Follow these step to **manually** disable the protocols: 
 + 
 +  - Open the registry editor 
 +  - Navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client 
 +  - Set the DisabledByDefault entry DWORD value to 1 
 +  - Set the Enabled entry DWORD value to 0 
 +  - Navigate to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server 
 +  - Set the DisabledByDefault entry DWORD value to 1 
 +  - Set the Enabled entry DWORD value to 0 
 +  - Repeat for TLS 1.1 
 +  - Reboot server 
 + 
 +{{ :versago:app_security01.png?600 |}} 
 + 
 +===== Require Server Name Indication ===== 
 + 
 +Define a host name and set 'Require Server name Indication' in the bindings settings for the Versago site. 
 + 
 +  - Open IIS Manager 
 +  - Select the Versago Site on the left pane 
 +  - Go to the Actions pane to the right and select and edit Bindings 
 +  - set Hostname to your site's name and select Require Server Name Indication as shown below
  
-The following shows how to create a self-signed SSL certificate.+{{ :versago:app_security02.png?600 |}}
  
-  - Open the Windows IIS Manager (Administrative Tools > IIS Manager) 
-  - Select the server under the Connections pane 
-  - Double click the “Server Certificates” icon in the IIS section of the page \\ \\ {{:versago:selfssl1.png?600|}} \\ \\ 
-  - Click on “Create Self-Service Certificates” in the Actions pane 
-  - Name the certificate and store it under Personal \\ \\ {{:versago:selfssl2.png?600|}} 
  
-   
versago/versago_application_security.1598970422.txt.gz · Last modified: 2020/09/01 10:27 by dlee

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial 4.0 International
CC Attribution-Noncommercial 4.0 International Valid HTML5 Valid CSS Driven by DokuWiki