Browser Based Launcher Strong Cipher Settings & TLS

By editing the gateway.conf file you can force the Browser Based Launcher to communicate on certain Ciphers, and disable old TLS settings, for extra security. Below is an example cipherSuites settings that you can add which will omit any less secure Ciphers, as well as the recommended SSL Protocols setting. You can copy and paste this code below into your gateway.conf file, ensuring the text is on a single line as per the screenshot below, and then restart your Passwordstate Gateway service for it to take effect.

These settings below may already exist in your gateway.conf file, if you are using build 9785 or later.

Cipher Suites

Add the following block of text to your gateway.conf file.

cipherSuites=
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_E CDH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RS A_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WIT H_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_ 256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CB C_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_E CDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_ WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_ 128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_S HA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_EC DH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA

SSL Protocols

Modify the sslProtocols section of the document, to only use TLS 1.2. as per the example below.

sslProtocols=TLSv1.2