Encrypt communication with TLS

To fix vulnerabilities on your organization's corporate network, you can enable traffic encryption by using the TLS protocol. You can enable TLS encryption protocols and supported cipher suites on Administration Server. Open Single Management Platform supports the TLS protocol versions 1.0, 1.1, 1.2, and 1.3. You can select the required encryption protocol and cipher suites.

Open Single Management Platform uses self-signed certificates. You can also use your own certificates. We recommend using certificates issued by trusted certificate authorities.

To configure allowed encryption protocols and cipher suites on Administration Server:

1. On the administrator host where the KDT utility is located, run the following command:

   ./kdt invoke ksc --action klscflag --param klscflag_param=" -fset -pv ".core/.independent" -s Transport -n SrvUseStrictSslSettings -v <value> -t d"

   Use the SrvUseStrictSslSettings flag to configure allowed encryption protocols and cipher suites on Administration Server.

   Specify the <value> parameter of the SrvUseStrictSslSettings flag:

   • 4—Only the TLS 1.2 and TLS 1.3 protocols are enabled. Also, cipher suites with TLS_RSA_WITH_AES_256_GCM_SHA384 are enabled (these cipher suites are needed for backward compatibility with Kaspersky Security Center 11). This is the default value.

     Cipher suites supported for the TLS 1.2 protocol:

     • ECDHE-RSA-AES256-GCM-SHA384
     • ECDHE-RSA-AES256-SHA384
     • ECDHE-RSA-CHACHA20-POLY1305
     • AES256-GCM-SHA384 (cipher suite with TLS_RSA_WITH_AES_256_GCM_SHA384)
     • ECDHE-RSA-AES128-GCM-SHA256
     • ECDHE-RSA-AES128-SHA256

     Cipher suites supported for the TLS 1.3 protocol:

     • TLS_AES_256_GCM_SHA384
     • TLS_CHACHA20_POLY1305_SHA256
     • TLS_AES_128_GCM_SHA256
     • TLS_AES_128_CCM_SHA256
   • 5—Only the TLS 1.2 and TLS 1.3 protocols are enabled. For the TLS 1.2 and TLS 1.3 protocols, the specific cipher suites listed below are supported.

     Cipher suites supported for the TLS 1.2 protocol:

     • ECDHE-RSA-AES256-GCM-SHA384
     • ECDHE-RSA-AES256-SHA384
     • ECDHE-RSA-CHACHA20-POLY1305
     • ECDHE-RSA-AES128-GCM-SHA256
     • ECDHE-RSA-AES128-SHA256

     Cipher suites supported for the TLS 1.3 protocol:

     • TLS_AES_256_GCM_SHA384
     • TLS_CHACHA20_POLY1305_SHA256
     • TLS_AES_128_GCM_SHA256
     • TLS_AES_128_CCM_SHA256

   We do not recommend using 0, 1, 2, or 3 as the parameter value of the SrvUseStrictSslSettings flag. These parameter values correspond to insecure TLS protocol versions (the TLS 1.0 and TLS 1.1 protocols) and insecure cipher suites, and are used only for backward compatibility with earlier Kaspersky Security Center versions.

2. Restart the following Open Single Management Platform services:
   • Administration Server
   • Web Server
   • Activation Proxy

Traffic encryption by using the TLS protocol is enabled.

You can use the KLTR_TLS12_ENABLED and KLTR_TLS13_ENABLED flags to enable the support of the TLS 1.2 and TLS 1.3 protocols, respectively. These flags are enabled by default.

To enable or disable the support of the TLS 1.2 and TLS 1.3 protocols,

On the administrator host where the KDT utility is located, run one of the following commands:

• To enable or disable the support of the TLS 1.2 protocol:

  ./kdt invoke --action klscflag --param klscflag_param=" -fset -pv ".core/.independent" -s Transport -n KLTR_TLS12_ENABLED -v <value> -t d"

• To enable or disable the support of the TLS 1.3 protocol:

  ./kdt invoke --action klscflag --param klscflag_param=" -fset -pv ".core/.independent" -s Transport -n KLTR_TLS13_ENABLED -v <value> -t d"

Specify the <value> parameter of the flag:

• 1—To enable the support of the TLS protocol.
• 0—To disable the support of the TLS protocol.