1

We have a AEM (Adobe experience manager) 6.2 application.

I recently been advised to exclude/remove the weak ciphers for strict security policies. But I am not sure where shall I do the configuration changes because our request flows through first Akamai, Load balancer, Publisher dispatcher, publisher sequentially. Apart from Akamai , everything is deployed in AWS.

Every request first hits the Akamai so I am assuming that cipher negotiation happens between browser and Akamai and then SSL handshake happens.

Also, I am not my concern at the moment but curios to figure out, where does the ssl handshake is taking place browser to (Akamai or load balancer, dispatcher, publisher)

Thanks!

Improve this question
1
  • It seems people here don't know how that particular CMS is usually deployed. A CDN like Akamai can do different things from fully hosting the site such that the origin web server is not reachable by end user browsers to hosting just the assets (like media files). You can use the network tab in developer tools in Chrome to find all domains to which the browser connects when loading the page (and interacting with it, like leaving a comment). You want a good TLS config on all those domains, whether they are served by Akamai, AWS S3, AWS ELB, apache on linux you manage on AWS EC2, etc.
    – Z.T.
    Mar 25, 2019 at 22:23

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .