Relaxing Commander cipher suite security

Accessing Commander or the VM Access Proxy with unsupported browsers may result in SSL-related errors that prevent usage. Common errors include SSL_ERROR_PROTOCOL_VERSION_ALERT and ERR_SSL_VERSION_OR_CIPHER_MISMATCH. If these issues occur, use a supported browser first.

If you encounter one of these errors, start by using a supported browser that works with TLS 1.2 and a modern, secure cipher suite. While it is possible to configure Commander with less secure settings, this approach is not recommended. If lowering security is required for business continuity, follow the steps in the sections below to implement a relaxed configuration.

Applying a relaxed security configuration to Commander

1. Create a backup of your ..\tomcat\conf\server.xml file.
2. Open ..\tomcat\conf\server.xml with a text editor.
3. Locate the Connector line that defines the SSLEnabled and keystoreFile attributes.
4. Remove the useServerCipherSuitesOrder attribute completely.
5. Replace the value of the ciphers attribute with the following:

   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

6. Restart the Commander service or the entire application server.

Applying a relaxed security configuration to the VM Access Proxy

1. Create a backup of your /var/data/conf/server.xml file.
2. Open /var/data/conf/server.xml with a text editor.
3. Locate the live Connector that defines the keystoreFile attribute.
4. Remove the useServerCipherSuitesOrder attribute completely.
5. Replace the value of the ciphers attribute with the following:
   

   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
   TLS_RSA_WITH_AES_128_CBC_SHA256,
   TLS_RSA_WITH_AES_128_CBC_SHA,
   TLS_RSA_WITH_AES_256_CBC_SHA256,
   TLS_RSA_WITH_AES_256_CBC_SHA

6. Restart the remoteaccess and guacd containers by navigating to the folder containing your unzipped proxy contents (which includes docker-compose.yml) and issuing:

   docker-compose down && docker-compose up -d

Outcome

The configuration changes allow Commander and the VM Access Proxy to accept older cipher suites, enabling access through unsupported browsers when required.