[id='configuring-ssl-engine_{context}']
= Configuring TLS versions and cipher suites

When using SSL/TLS encryption to secure your deployment, you can configure {brandname} Server to use specific versions of the TLS protocol as well as specific cipher suites within the protocol.

.Procedure

. Open your {brandname} Server configuration for editing.
. Add the `engine` element to the SSL configuration for {brandname} Server.
. Configure {brandname} to use one or more TLS versions with the `enabled-protocols` attribute.
+
{brandname} Server supports TLS version 1.2 and 1.3 by default.
If appropriate you can set `TLSv1.3` only to restrict the security protocol for client connections.
{brandname} does not recommend enabling `TLSv1.1` because it is an older protocol with limited support and provides weak security.
You should never enable any version of TLS older than 1.1.
+
[WARNING]
====
If you modify the SSL `engine` configuration for {brandname} Server you must explicitly configure TLS versions with the `enabled-protocols` attribute.
Omitting the `enabled-protocols` attribute allows any TLS version.

[source,xml,options="nowrap",subs=attributes+]
----
<engine enabled-protocols="TLSv1.3 TLSv1.2" />
----
====
+
. Configure {brandname} to use one or more cipher suites with the `enabled-ciphersuites` attribute (for TLSv1.2 and below) and the `enabled-ciphersuites-tls13` attribute (for TLSv1.3).
+
You must ensure that you set a cipher suite that supports any protocol features you plan to use; for example `HTTP/2 ALPN`.
. Save the changes to your configuration.

[discrete]
== SSL engine configuration

.XML
[source,xml,options="nowrap",subs=attributes+]
----
include::xml/server_ssl_identity_engine.xml[]
----

.JSON
[source,json,options="nowrap",subs=attributes+]
----
include::json/server_ssl_identity_engine.json[]
----

.YAML
[source,yaml,options="nowrap",subs=attributes+]
----
include::yaml/server_ssl_identity_engine.yaml[]
----
