@nqhiep wrote:
When I define a new target server, I don't specify the tls version, how can I know what is the version is used?
I think if you want to specify the TLS settings, you need to use a SSLInfo block. Is that what you're asking?
A long, long time ago, in a galaxy far, far away, Apigee was created and the designers thought , "let's make SSL (now TLS) really easy and just choose some defaults for people." And so officially, it was not required for you to specify a SSLInfo block in your TargetEndpoint. This is nice for conducting tests, but it's a poor choice for enterprise-grade governance. So you should never do this in real-world systems. You should never omit the SSLInfo block.
BTW, The apigeelint tool , which I recommend without reservations, will flag this for you, under rule TD012. If it finds a TargetEndpoint in your proxy that does not use SSLInfo, apigeelint will scold you and say "TargetEndpoint HTTPTargetConnection should have exactly one SSLInfo".
Also, I advocated for the product team to change this behavior and insist that every TargetEndpoint use its own SSLInfo, or at least provide a way for the Org Admin to specify a flag that would require that each TargetEndpoint must use an SSLInfo. But we decided that would be too much of a hardship for people who are just testing things out. So you need to enforce that kind of thing on your own.
For Apigee Edge, you can find the relevant documentation for SSLInfo here. It will tell you how to specify acceptable protocols (TLS 1.1, TLS1.2) and ciphers, etc.
For Apigee x/hybrid, look here.
LinkedIn
Twitter
