Cipher suits to be added for disabling Weak Ciphers in APIM

Description:

The documentation [1] cites the set of ciphers that are secure in Tomcat [3]. However, the ciphers[3] are in the OpenSSL name standard and the format used in the APIM 4.1.0 deployment.toml[2] configuration is the "Cipher Suite Name (IANA)".

We have a problem here, the documentation [1] can lead the user to an error, as he would be asking to use a cipher in the IANA standard in deployment.toml.

With that, could you verify/test that using cipher names in the OpenSSL standard will work for configuring PassThrough transport-level cipher names?

If that doesn't work, we'll have to change the documentation to recommend that customers use the ciphers in the IANA naming standard to configure tomcat[2] and find the correct names in the OpenSSL standard from the IANA names[4].

[1] https://apim.docs. wso2 .com/en/4.1.0/install-and-setup/ setup/reference/supported-cipher-suites/
[2]https://apim.docs.wso2.com/en/4.1.0/install-and-setup/setup/security/configuring-transport-level-security/#disabling-weak-ciphers-for-the- tomcat-transport
[3] https://ssl-config.mozilla.org/#server=tomcat&version=9.0.30&config=intermediate&guideline=5.6
[4] https://ciphersuite.info/cs/TLS_DHE_RSA_WITH_AES_256_GCM_SHA384/

Suggested Labels:
API-M-4.1.0, Type/Doc

Affected Product Version:
APIM 4.1.0

Start with the linked supported-cipher-suites and transport-level-security documentation, then inspect the APIM 4.1.0 deployment.toml cipher configuration and the referenced Tomcat/OpenSSL and IANA cipher lists. Verify which naming standard PassThrough transport accepts; done means the documentation recommends the correct names and avoids sending users to an invalid configuration.