Can I disable RC4 in favor of a stronger Cipher

Question

I'm deploying ArcGIS for Server 10.3.1 in a secure Enterprise environment.  A recent scan showed we had the RC4 cipher enabled, and being used on Port 6443.  We use the Web Adaptor, and the firewall blocks all in/out 6443 traffic, but my life would become substantially easier from a documentation and risk acceptance standpoint if I could configure the server to use TLS with 3DES or another stronger cipher.  Is it possible to configure this somewhere in the ArcGIS settings?

I tried flat-out disabling RC4 before, and it broke the server.  I began to get SCHANNEL errors saying I didn't have a cipher available to establish the connection.

JoelBennett · Answer

We too have this same issue with 10.3.1. We will be bypassing 10.4 for 10.5 later this year, and I do not see how changing registry settings or playing with third party software for IIS will fix this problem since it's coming from ArcGIS Server's web server Tomcat. Instead, the fix I found was to modify the configuration for the Tomcat server. Refer also to HOW TO -- Disable weak ciphers in Tomcat 7 & 8 - Powered by Kayako Help Desk Software for more information on the parameters mentioned below. Here are my instructions for Windows: 1) Make a backup copy of \framework untime omcat\conf\server.xml 2) Run Notepad as Administrator 3) Open \framework untime omcat\conf\server.xml 4) Near the bottom of the file, look for the line that starts with

RandallWilliams · Answer

At 10.4 in the security configuration page in the admin API you can specify the HTTPS protocols and ciphers you'd like to support.

ThomasColson · Answer

This can be accomplished with registry settings, but I prefer a tool "IISCrypto" which give you a nice GUI to not only turn protocols on or off, but specify the order of the ciphers as well. Is your certificate using SHA-2?