Configure Security Protocols and Cipher Suites for Blast Secure Gateway (BSG)

You can configure the security protocols and cipher suites that BSG's client-side listener accepts by editing the file absg.properties.

Note: The security settings for Connection Server do not apply to BSG. You must configure security for BSG separately.

The supported protocols are as follows:

Older protocols such as SSLv3 and earlier are never allowed.

Two properties, localHttpsProtocolLow and localHttpsProtocolHigh, determine the range of protocols that the BSG listener will accept. For example, setting localHttpsProtocolLow=tls1.1 and localHttpsProtocolHigh=tls1.3 will configure the listener to accept TLS 1.1, TLS 1.2, and TLS 1.3. You can examine the BSG's absg.log file to discover the values that are in force for a specific BSG instance.

You must specify the list of ciphers using the format that is defined in OpenSSL. You can search for openssl cipher string in a web browser and see the cipher list format. The default cipher lists are as follows:

ECDHE+AESGCM

TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384

Note: In FIPS mode, only GCM cipher suites are enabled (ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256).

Procedure

1. On the Connection Server instance, edit the file install_directory\Omnissa\Horizon\Server\appblastgateway\absg.properties.

   By default, the installed directory is %ProgramFiles%.

2. Edit the properties localHttpsProtocolLow and localHttpsProtocolHigh to specify a range of protocols.

   For example,

   localHttpsProtocolLow=tls1.1
   localHttpsProtocolHigh=tls1.3
   

   To enable only one protocol, specify the same protocol for both localHttpsProtocolLow and localHttpsProtocolHigh.

3. Edit the localHttpsCipherSpec property to specify a list of cipher suites.

   For example,

   localHttpsCipherSpec=!aNULL:kECDH+AESGCM:ECDH+AESGCM:kECDH+AES:ECDH+AES
   

4. Restart the Windows service Horizon Blast Secure Gateway.