Use of TLS

Oracle strongly recommends configuring WebLogic to use TLS and accessing the Empirica Healthcare Analysis software using only TLS connections. For more information, see the Installation Guide.

To ensure that your use of TLS is secure, perform the following steps:

• Disable the use of vulnerable TLS protocols by adding the following JVM option to the JAVA_OPTIONS settings in the setDomainEnv.sh file:

  -Dweblogic.security.SSL.protocolVersion=TLS1

  You can find the setDomainEnv.sh file in a location such as:

  /u01/app/oracle/Middleware/user_projects/domains/empirica/bin/setDomainEnv.sh

• Enable only strong ciphers in the WebLogic config.xml file by listing only strong ciphers in the SSL section of the WebLogic config.xml file.

  Do not include the following weak ciphers:

  • DES 56/56
  • NULL
  • RC2 40/12k
  • RC2 56/128
  • RC4 40/128
  • RC4 56/128
  • RC4 64/128
  • PCT1.0\Server
  • SSL 2.0/Server
  • SSL 3.0/Server