SSL Certificate Signed using Weak Hashing Algorithm

SSL Certificate Signed using Weak Hashing Algorithm
Troubleshooting

Problem
Nessus scanner reports an issue: The SSL certificate has been signed using a weak hash algorithm.

Symptom
Issue:
SSL Certificate Signed using Weak Hashing Algorithm

Synopsis :

The SSL certificate has been signed using a weak hash algorithm.

Description :

The remote service uses an SSL certificate that has been signed using a cryptographically weak hashing algorithm - MD2, MD4, or MD5. These signature algorithms are known to be vulnerable to collision attacks.
In theory, a determined attacker may be able to leverage this weakness to generate another certificate with the same digital signature, which could allow him to masquerade as the affected service.

Cause
The embedded WebSphere Application Server (eWAS) serves an SSL certificate that is hashed by MD5 which is vulnerable to a collision attack.

Resolving The Problem
To resolve this issue, generate your own self-signed certificates:

1. Make a backup copy of the original SSL certificate file:

TWA_Home/eWAS/profiles/TIPProfile/etc/TWSServerKeyFile.jks

2. Run the executable script ikeyman.sh found in:

TWA_Home/eWAS/bin

3. Load the file TWSServerKeyFile.jks found in:

TWA_Home/eWAS/profiles/TIPProfile/etc/

When prompted for a password enter the word: default

4. Delete the server certificate.

5. Create new server certificate by selecting: New Self-Signed

6. Fill in the requested information. Use SHA-2 as the hashing algorithm.

7. Save as a JKS file with the filename:

TWA_Home/eWAS/profiles/TIPProfile/etc/TWSServerKeyFile.jks

8. Restart eWAS

Product Alias/Synonym
Maestro
TWS
TWA