Fips Compliance; Ssl Configuration Task List; Configuring An Ssl Server Policy - HPE FlexNetwork 5510 HI Series Security Configuration Manual

Figure 115 SSL protocol stack
SSL handshake protocol
The following describes the major functions of SSL protocols:
•
SSL record protocol—Fragments data received from the upper layer, computes and adds
MAC to the data, and encrypts the data.
•
SSL handshake protocol—Negotiates the cipher suite used for secure communication,
authenticates the server and client, and securely exchanges the keys between the server and
client. The cipher suite that needs to be negotiated includes the symmetric encryption
algorithm, key exchange algorithm, and MAC algorithm.
•
SSL change cipher spec protocol—Notifies the receiver that subsequent packets are to be
protected based on the negotiated cipher suite and key.
•
SSL alert protocol—Sends alert messages to the receiving party. An alert message contains
the alert severity level and a description.

FIPS compliance

The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode (see
non-FIPS mode.

SSL configuration task list

Tasks at a glance

Configuring an SSL server policy

Configuring an SSL client policy
Configuring an SSL server policy
An SSL server policy is a set of SSL parameters used by the SSL server. An SSL server policy takes
effect only after it is associated with an application such as HTTPS.
SSL protocol versions include SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2. By default:
•
In Release 1111, the SSL server can communicate with clients running SSL 3.0 and TLS 1.0.
When the server receives an SSL 2.0 Client Hello message from a client, it notifies the client to
use SSL 3.0 or TLS 1.0 for communication.
•
In Release 1121 and later, the SSL server can communicate with clients running all SSL
protocol versions. When the server receives an SSL 2.0 Client Hello message from a client, it
notifies the client to use a later version for communication.
You can disable specific SSL protocol versions on the device to enhance system security.
To configure an SSL server policy:
Application layer protocol (e.g. HTTP)
SSL change cipher spec protocol
SSL record protocol
TCP
IP
SSL alert protocol
Remarks
Perform this configuration task on the SSL server.
Perform this configuration task on the SSL client.
394
"Configuring FIPS") and