From 9cae529e0fefc48360315b929d9d70192aaed304 Mon Sep 17 00:00:00 2001
From: Terry Fleury <tfleury@illinois.edu>
Date: Mon, 1 Feb 2021 13:51:27 -0600
Subject: [PATCH] Configure Tomcat to require TLS v1.2 as proposed in the
 InCommon Baseline Expectations 2.0
 (https://spaces.at.internet2.edu/x/4YbVCQ).

---
 container_files/tomcat/server.xml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/container_files/tomcat/server.xml b/container_files/tomcat/server.xml
index 36a4e81..c2d61d3 100644
--- a/container_files/tomcat/server.xml
+++ b/container_files/tomcat/server.xml
@@ -4,12 +4,18 @@
   <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
 
   <Service name="Catalina">
-<Connector
+
+    <Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="443" maxThreads="200"
-          scheme="https" secure="true" SSLEnabled="true"
-          keystoreFile="/opt/certs/keystore.jks" keystorePass="password"
-          clientAuth="false" sslProtocol="TLS"/>
+          scheme="https" secure="true" SSLEnabled="true">
+      <SSLHostConfig protocols="TLSv1.2">
+        <Certificate
+          certificateKeystoreFile="/opt/certs/keystore.jks" 
+          certificateKeystorePassword="password" />
+      </SSLHostConfig>
+    </Connector>
+
     <Engine name="Catalina" defaultHost="localhost">
 
       <Host name="localhost"  appBase="webapps"