Configure TLS Security Settings

Use these settings to configure the appliance's security settings and policies.

1. In the admin UI, click Security in the left navigation pane.

2. In the Security Settings card, click Configure.

3. Enter the following details and click Save.

   Setting	Description
   TLS Server Cipher Suites	Enter a comma-separated list of cipher suites, which are cryptographic algorithms used to encrypt inbound TLS connections to Unified Access Gateway. This option is used with few other options such as TLS versions, named groups, signature schemes, and so on that are used in enabling various security protocols. The TLS Server Cipher suites supported in FIPS mode are as follows: Default cipher suites configured in FIPS mode with TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 When TLS 1.3 is enabled in FIPS mode, these ciphers will also be enabled: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 The default TLS Server Cipher suites supported in non-FIPS mode are as follows: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 This option can be configured during PowerShell deployment by adding the cipherSuites parameter in the ini file. See Run PowerShell script to deploy.
   TLS Client Cipher Suites	Enter a comma-separated list of cipher suites, which are cryptographic algorithms used to encrypt outbound TLS connections to Unified Access Gateway. This option is used with few other options such as TLS versions, named groups, signature schemes, and so on that are used in enabling various security protocols. The following cipher suites are supported in FIPS mode with TLS 1.2: - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 When TLS 1.3 is enabled in FIPS mode, these ciphers will also be enabled: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 In the non-FIPS mode, by default, all cipher suites that are supported by the SSL library (Java/Open SSL) can be used. This option can be configured during PowerShell deployment by adding the outboundCipherSuites parameter in the ini file. See Run PowerShell script to deploy.
   Minimum SHA Hash Size	Select the Minimum SHA Hash Size for Horizon protocols and all non-horizon connections during communication and for certificate thumbprint specification. SHA-256 is the default. The supported SHA hash size values are: SHA-1, SHA-256, SHA-384, and SHA-512. SHA-1 is not recommended.
   Enable TLS 1.2	By default, this toggle is turned on. The TLS 1.2 security protocol is enabled.
   Enable TLS 1.3	By default, this toggle is turned on for non-FIPS appliances. The TLS 1.3 security protocol is enabled. In FIPS appliances, this protocol is not enabled by default. However, the administrator can enable it when necessary.
   SSL Provider	Select the SSL Provider implementation used for handling TLS connections. To configure TLS Named Groups and TLS Signature Schemes, the value of this option must be JDK. By default, the value of this option is OPENSSL. Note: When this option is set to JDK, OCSP stapling for the UAG internet facing TLS server certificate is not supported. Any changes to this option will result in Unified Access Gateway services getting restarted. Ongoing Unified Access Gateway sessions are not retained during the restart. This option can be configured during a PowerShell deployment by adding the sslProvider parameter in the ini file. See Run PowerShell script to deploy.
   TLS Named Groups	Allows the administrator to configure the desired named groups (elliptic curves) from a list of supported named groups used for key exchange during SSL handshake. This option allows comma-separated values. Some of the supported named groups are as follows: secp256r1, secp384r1, secp521r1. To configure this option, ensure that the SSL Provider option is set to JDK. Otherwise, the TLS Named Groups option is disabled. Any changes to this option will result in Unified Access Gateway services getting restarted. Ongoing Unified Access Gateway sessions are not retained during the restart. Note: This option can be configured during a PowerShell deployment by adding the tlsNamedGroups parameter in the ini file. See Run PowerShell script to deploy.
   TLS Signature Schemes	Allows the administrator to configure the supported TLS signature algorithms used for key validation during SSL handshake. This option allows comma-separated values. Example supported signature schemes: rsa_pkcs1_sha, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp521r1_sha512. To configure this option, ensure that the SSL Provider option is set to JDK. Otherwise, the TLS Signature Schemes option is disabled. Any changes to this option will result in Unified Access Gateway services getting restarted. Ongoing Unified Access Gateway sessions are not retained during the restart. Note: This option can be configured during PowerShell deployment by adding the tlsSignatureSchemes parameter in the ini file. See Run PowerShell script to deploy.
   Allowed Host Headers	Enter the IP address and/or the host name to allow as host header values. This setting applies to Horizon, Web Reverse Proxy use cases, and the Admin service on Unified Access Gateway. Validation of the Host (or X-Forwarded-Host) header is enabled by default against values configured in this field and a dynamically computed auto-allowed list based on the UAG's network settings and Edge Service Settings. Any hostnames used for accessing the Unified Access Gateway directly, via load balancer, or reverse proxy and are not included in the auto-allowed list should be configured in this field. For Unified Access Gateway deployments with Horizon, if Blast Secure Gateway (BSG) and/or Tunnel are enabled and external URLs are configured, these values are automatically included in the allowed host value list. Explicit configuration of these values is not required. For Unified Access Gateway deployments with Web Reverse Proxy configurations, the external URL and proxy host patterns are included in the auto-allowed list of host values. When Unified Access Gateway is deployed with an N+1 Virtual IP (VIP), the virtual IP is included in the auto-allowed list. In addition, the UAG's non-loopback IP addresses and internal hostname are also included in this list and allowed by default.
   Auto-Allowed Host Headers	The values in this setting are included to the list of "Allowed Values" for Host/X-Forwarded-Host header validation. The values are calculated dynamically based on the appliance's network configurations, Edge settings, HA, system configuration, and so on. For more information, see Host Header Validation on Unified Access Gateway.