outgoing deep ssl scanning

Avgerinos:

I’m going to assume you are on-prem…

This is what I have running on my install

Export the windows cert to PKCS12 (3DES) and make sure you have the password, save it wherever you want, I usually use c:\program files\sysaidserver

Cert path and password get put into the tomcat conf… and it strange as it may seem put the password in plain text. The system will hash it after you restart tomcat

C:\Program Files\SysAidServer\tomcat\conf\server.conf around line 70

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="C:\Program Files\SysAidServer\Cert-Name.pfx" keystoreType="PKCS12" KeystorePass="hashed-password" sslEnabledProtocols="TLSv1.2,TLSv1.3" ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"/>

this also assumes you get the port to 443 from the default 8443, so your mileage may vary

hope that helps

John

Hi @Avgerinos, 

Please go to Email integration, click on a test button to check the connection, and provide us with the exact error that you receive. 

Thanks

@jsidoti Thank you for your answer. 
I will try it on the next maintenance window, for the time being the deep ssl rule affecting the ticketing platform has been turned off. 

@NatCohenSheffer attached the two images  ;