225
FLASH
MEDIA
SERVER
4.5
CONFIGURATION
AND
ADMINISTRATION
XML configuration files reference
Last updated 11/28/2012
SSLCACertificatePath
Located in the
SSLClientCtx
container.
Specifies the name of a directory containing CA certificates. Each file in the directory must contain only a single CA
certificate. File names must be the hash with “0” as the file extension.
For Win32 only: If this element is empty, attempts are made to find CA certificates in the certs directory located at the
same level as the conf directory. The Windows certificate store can be imported into this directory by running
FMSMaster - console - initialize
from the command line.
SSLCipherSuite
Located in the
SSLClientCtx
container.
Specifies the suite of encryption ciphers that the server uses to secure communications.
This element is a colon-delimited list of encryption resources, such as a key-exchange algorithm, authentication
method, encryption method, digest type, or one of a selected number of aliases for common groupings. Each item in
the cipher list specifies the inclusion or exclusion of an algorithm or cipher. In addition, there are special keywords and
prefixes. For example, the keyword
ALL
specifies all ciphers, and the prefix
!
removes the cipher from the list.
The default cipher list instructs the server to accept all ciphers, but block those using anonymous Diffie-Hellman
authentication, block low-strength ciphers, block export ciphers, block MD5 hashing, and sort ciphers by strength
from highest to lowest level of encryption.
Important:
Contact Adobe Support before changing the default settings.
The cipher list consists of one or more cipher strings separated by colons. Commas or spaces are also acceptable
separators, but colons are normally used.
The string of ciphers can take several different forms.
•
It can consist of a single cipher suite, such as RC4-SHA.
•
It can represent a list of cipher suites containing a certain algorithm, or cipher suites of a certain type.
For example,
SHA1
represents all cipher suites using the digest algorithm SHA1, and
SSLv3
represents all SSL v3
algorithms.
•
Lists of cipher suites can be combined in a single cipher string using the
+
character as a logical
and
operation.
For example,
SHA1+DES
represents all cipher suites containing the
SHA1
and
DES
algorithms.
•
Each cipher string can be optionally preceded by the characters
!
,
-
, or
+
.
•
If
!
is used, then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the
list even if they are explicitly stated.
•
If
-
is used, then the ciphers are deleted from the list, but some or all of the ciphers can be added again later.
•
If
+
is used, then the ciphers are moved to the end of the list. This option doesn't add any new ciphers—it just moves
matching existing ones.
•
If none of these characters is present, then the string is just interpreted as a list of ciphers to be appended to the
current preference list.
•
If the list includes any ciphers already present, the server does not evaluate them.
•
The cipher string
@STRENGTH
sorts the current cipher list in order of the length of the encryption algorithm key.