These settings control TLS protocol versions and SSL behavior for Threat Manager components. All settings are configured by editing docker-compose_v10.yaml directly. For certificate management tasks such as generating a CSR or installing a signed certificate, refer to (On-premises) Generating a certificate signing request in Additional administrative tasks.

In this section:

(On-premises) Disable older TLS versions

You can disable connection requests from specified versions of TLS, for example TLS 1.0 or TLS 1.1.

Task: Disable older TLS versions

1. Open docker-compose_v10.yaml with a suitable editing program.

2. Under analytics-ui, within the environment: subsection, set APACHE_SSL_PROTOCOL to specify which TLS versions to disable:

   APACHE_SSL_PROTOCOL=

   For example, to disable TLS 1.0 only:

   APACHE_SSL_PROTOCOL=all -TLSv1

3. Under analytics-dataimporter-restapi, within the environment: subsection, add entries to specify which TLS versions to enable:

   - SERVER_SSL_PROTOCOL=TLS

   - SERVER_SSL_ENABLED_ENABLEDPROTOCOLS="TLSv1.2, TLSv1.3"

   In this example, TLS versions 1.2 and 1.3 are enabled and earlier versions are disabled.

4. Save docker-compose_v10.yaml.

5. Restart the Docker stack to apply the changes. Refer to Stopping and restarting the Docker stack to apply new settings.

(On-premises) SSL/TLS configuration between Threat Manager data importer and SQL Server

The iManage Threat Manager data importer and SQL Server can be connected over TLS.

There are three modes:

• On: Certificate must be in production and match one of Java’s default CA Authorities

• Off: Default value

• Testing: SSL on, but no validation on certificate

Task: Configure SSL/TLS between data importer and SQL Server

1. Open docker-compose_v10.yaml with a suitable editing program.

2. Under analytics-dataimporter, within the environment: subsection, add the parameters for your required mode.

   • On (SSL with certificate validation):

     - EXTRACTORCONFIG_SQL_ISSSL=true

     - EXTRACTORCONFIG_SQL_ISCERTVALIDATION=true

   • Off (no SSL, the default; this applies regardless of whether the value is explicitly set):

     - EXTRACTORCONFIG_SQL_ISSSL=false

     If using TLS 1.1 or 1.2 on the SQL Server, also add:

     JDK_TLS_DEPRECATEDALGORITHMS_ENABLED=TRUE

   • Testing (SSL on, no certificate validation):

     - EXTRACTORCONFIG_SQL_ISSSL=true

     - EXTRACTORCONFIG_SQL_ISCERTVALIDATION=false

3. Save docker-compose_v10.yaml.

4. Restart the Docker stack to apply the changes. Refer to Stopping and restarting the Docker stack to apply new settings.

(On-premises) TLS_DEPRECATEDALGORITHMS_ENABLED

When set to true, TLS_DEPRECATEDALGORITHMS_ENABLED enables the use of TLS 1.1 or 1.2 on the Work SQL Server connected to Threat Manager.

Task: Configure TLS_DEPRECATEDALGORITHMS_ENABLED

1. Open docker-compose_v10.yaml with a suitable editing program.

2. Under analytics-engine, within the environment: subsection, add the following parameter when using TLS 1.1 or 1.2:

   TLS_DEPRECATEDALGORITHMS_ENABLED=TRUE

3. Save docker-compose_v10.yaml.

4. Restart the Docker stack to apply the changes. Refer to Stopping and restarting the Docker stack to apply new settings.

(On-premises) iManage Work Server SSL setting

By default, iManage Threat Manager only allows the addition of iManage Work Servers configured as HTTPS-compliant. This prevents the addition of, for example, iManage Work servers using self-signed certificates.

iManage recommends not adjusting this value in production. However, if you are connecting to an iManage Work Server that is not HTTPS-compliant, for example in a test environment, you can override this setting.

Task: Update the iManage Work Server SSL setting

1. Open docker-compose_v10.yaml with a suitable editing program.

2. Under analytics-engine, within the environment: subsection, add the following:

   - REQUIRE_WORK_SSL=FALSE

3. Save docker-compose_v10.yaml.

4. Restart the Docker stack to apply the changes. Refer to Stopping and restarting the Docker stack to apply new settings.