The SSL/TLS server-client handshake involves negotiating cipher suites to be used for encryption and decryption on each side of a secured transaction. Cipher suites are stored in the following configuration files:

  • com.pingidentity.crypto.SunJCEManager.xml
  • com.pingidentity.crypto.AWSCloudHSMJCEManager.xml
  • com.pingidentity.crypto.LunaJCEManager.xml
  • com.pingidentity.crypto.NcipherJCEManager.xml

These cipher-suite configuration files are located in the <pf_install>/server/default/data/config-store directory. Weaker cipher suites are commented out in these files. Retain this cipher-suite configuration to ensure the most secure transactions.

Important:

Due to the import restrictions of some countries, Oracle Server JRE (Java SE Runtime Environment) 8 has built-in restrictions on available cryptographic strength (key size). To use larger key sizes, the Java Cryptography Extension (JCE) "unlimited strength" jurisdiction policy must be enabled. For more information, see the Java 8 release notes from Oracle (www.oracle.com/technetwork/java/javase/8u151-relnotes-3850493.html).

For Oracle Java SE Development Kit 11, the JCE jurisdiction policy defaults to unlimited strength. For more information, see the Oracle JDK Migration Guide (docs.oracle.com/en/java/javase/11/migrate/).

Starting with PingFederate 9.1, cipher suites are selected based on the order that they are listed in the cipher-suite configuration file for new installations. For upgrades, you may enable the same selection mechanism as well.

  • To enable, disable, or re-order cipher suites, follow these steps.
    1. Edit the applicable cipher-suite configuration file.
    2. Save your changes.
    3. Restart PingFederate.

      For a clustered PingFederate environment, perform these steps on the console node, and then click Replicate Configuration on the System > Cluster Management screen.

      Important: For each engine node, restart PingFederate to load the changes made in the cipher-suite configuration file after the configuration is replicated.
  • To enable cipher-suite selection based on listing order after an upgrade, follow these steps.
    1. Create a new text file with the following content: 
      <?xml version="1.0" encoding="UTF-8"?>
<c:config xmlns:c="http://www.sourceid.org/2004/05/config">
    <c:item name="prefer-server-cipher-suites">true</c:item>
</c:config>
    2. Save this file as cipher-suite-settings.xml in the <pf_install>/pingfederate/server/default/data/config-store directory.
    3. Restart PingFederate.

      For a clustered PingFederate environment, perform these steps on the console node, and then click Replicate Configuration on the System > Cluster Management screen.

      Important: For each engine node, restart PingFederate to load the changes made in the cipher-suite-settings.xml file after the configuration is replicated.