Configure Server HTTPS TLS Versions

This page explains how to configure the Mideye Server HTTPS listener for the default TLS 1.2 mode, for mixed TLS 1.2 and TLS 1.3 support, or for strict TLS 1.3 only.

This guidance changes the single HTTPS listener used by Mideye Server web endpoints.

The TLS mode on this listener affects:

• Admin Web Interface
• Self-service pages on the same server
• Credential Provider on-prem Token Verification Endpoint
• Other HTTPS endpoints served by Mideye Server (for example, API routes)

Credential Provider compatibility

If you use the Windows Credential Provider in on-prem mode, validate it after this change. Its Token Verification Endpoint runs on the same Mideye Server HTTPS listener, so TLS 1.3-only hardening can affect Credential Provider connectivity if the client environment does not negotiate TLS 1.3 successfully.

Default baseline vs hardened profile

By default, the Mideye Server HTTPS listener uses TLS 1.2. You can either keep that default, enable both TLS 1.2 and TLS 1.3, or change the listener to TLS 1.3 only by updating the SSL settings in application-prod.yml and restarting the service.

Before you start

Back up the current configuration before making protocol changes.

YAML indentation matters

Indentation in application-prod.yml is extremely important. Keep the same spacing structure as the existing file when you add or change server.ssl settings.

Platform	Default config path
Linux	/opt/mideyeserver6/config/application-prod.yml
Windows	C:\Program Files (x86)\Mideye Server 6\config\application-prod.yml

Changing TLS mode does not require replacing the HTTPS certificate. If you need to import, replace, or renew the certificate separately, see Certificate Management.

Linux examples

The configuration examples on this page use the default Linux path and port: /opt/mideyeserver6/config/keystore.p12 and 8443. Verify the actual keystore path and HTTPS listener port on your specific installation before applying changes.

Keep existing server settings

Your existing server section can include other settings (for example, compression) between port and ssl. Keep those settings unchanged.

Default configuration

With the standard SSL configuration, the HTTPS listener uses TLS 1.2.

server:
    port: 8443
    ssl:
        enabled: true
        key-store: /opt/mideyeserver6/config/keystore.p12
        key-store-password: "your-password"
        key-alias: webadmin

Note that it is possible that port, key-store, and key-store-password do not match your deployment.

Enable both TLS 1.2 and TLS 1.3

To allow both protocol versions, set enabled-protocols to TLSv1.2,TLSv1.3 and use a cipher list that includes suites for both TLS 1.2 and TLS 1.3.

server:
    port: 8443
    ssl:
        enabled: true
        key-store: /opt/mideyeserver6/config/keystore.p12
        key-store-password: "your-password"
        key-alias: webadmin
        enabled-protocols: TLSv1.2,TLSv1.3
        ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Note that it is possible that port, key-store, and key-store-password do not match your deployment.

Enable TLS 1.3 only

Update the server.ssl section in application-prod.yml so that only TLS 1.3 is enabled for the server HTTPS listener.

server:
    port: 8443
    ssl:
        enabled: true
        key-store: /opt/mideyeserver6/config/keystore.p12
        key-store-password: "your-password"
        key-alias: webadmin
        enabled-protocols: TLSv1.3
        ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256

Note that it is possible that port, key-store, and key-store-password do not match your deployment.

About cipher suites

Some existing config comments and older examples use long cipher lists centered on TLS 1.2-era suites. Those lists are not the right target for strict TLS 1.3 hardening.

Use the explicit TLS 1.3 cipher list shown above when changing the server HTTPS listener to TLS 1.3.

Procedure

1. Open application-prod.yml.

2. Find the server.ssl section.

3. Choose one of these modes:

   • enabled-protocols: TLSv1.2,TLSv1.3 for mixed support
   • enabled-protocols: TLSv1.3 for strict TLS 1.3 only

4. Set ciphers to match the chosen mode.

For mixed TLS 1.2 and TLS 1.3 support:

server:
    ssl:
        enabled-protocols: TLSv1.2,TLSv1.3
        ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

For TLS 1.3 only:

server:
    ssl:
        enabled-protocols: TLSv1.3
        ciphers: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256

5. Save the file.
6. Restart the Mideye Server service.

Linux

sudo systemctl restart mideyeserver6

Windows

Restart-Service MideyeServer6

Windows administrators can also restart the service from the GUI using services.msc.

Validate the change

After restart, test the mode you configured.

Validate mixed TLS 1.2 and TLS 1.3 support

Both commands must succeed:

openssl s_client -connect <host>:<port> -tls1_2

openssl s_client -connect <host>:<port> -tls1_3

Validate TLS 1.3-only hardening

TLS 1.3 must succeed:

openssl s_client -connect <host>:<port> -tls1_3

TLS 1.2 must fail:

openssl s_client -connect <host>:<port> -tls1_2

Confirm that:

• Admin Web Interface is still reachable in a supported browser.
• Self-service pages on the same server are still reachable.
• TLS 1.3 connections succeed when TLS 1.3 is enabled.
• TLS 1.2 connections succeed in the default TLS 1.2 mode and in mixed TLS 1.2 and TLS 1.3 mode.
• TLS 1.2 connections fail when TLS 1.3-only hardening is configured.
• If the Windows Credential Provider uses an on-prem Token Verification Endpoint on this server, its sign-in flow still works.
• Service logs do not show startup or handshake errors.

If the handshake result does not match the configured mode, verify that enabled-protocols and the cipher list match the intended configuration.

Compatibility and rollout risk

Strict TLS 1.3 can break older clients, scanners, reverse proxies, or middleware that still require TLS 1.2.

This includes the Windows Credential Provider when it is configured for on-prem verification against this Mideye Server.

Use a staged rollout when possible:

1. Test in a staging or maintenance window.
2. Validate browser and proxy compatibility.
3. Apply the change in production.

Confirm TLS 1.3-only operation by verifying that TLS 1.3 succeeds and TLS 1.2 is rejected.

Roll back

If strict TLS 1.3 causes compatibility issues:

1. Restore the previous application-prod.yml backup.
2. Restart the Mideye Server service.
3. Re-run the handshake tests.

Related links

• Application Configuration
• Certificate Management
• Administrative Web Interface