Use of SSL

Oracle strongly recommends configuring WebLogic to use SSL and accessing the Empirica Healthcare Analysis software using only SSL connections. For more information, see the Installation Guide.

To ensure that your use of SSL is secure, perform the following steps:

• Disable the use of vulnerable SSL protocols by adding the following JVM option to the JAVA_OPTIONS settings in the setDomainEnv.sh file:

  -Dweblogic.security.SSL.protocolVersion=TLS1

  You can find the setDomainEnv.sh file in a location such as:

  /u01/app/oracle/Middleware/user_projects/domains/empirica/bin/setDomainEnv.sh

• Enable only strong ciphers in the WebLogic config.xml file by listing only strong ciphers in the SSL section of the WebLogic config.xml file.

  Do not include the following weak ciphers:

  • DES 56/56
  • NULL
  • RC2 40/12k
  • RC2 56/128
  • RC4 40/128
  • RC4 56/128
  • RC4 64/128
  • PCT1.0\Server
  • SSL 2.0/Server
  • SSL 3.0/Server