The engine.ssl.protocols property within the run.properties file is used to explicitly define the SSL/TLS protocol versions that the PingFederate runtime engine's listeners will support. Administrators use this property to enhance security by disabling older, vulnerable protocols (e.g., SSLv3, TLSv1.0, TLSv1.1) and enforcing the use of modern, secure versions like TLSv1.2 and TLSv1.3. The value is a comma-separated list of the desired protocol versions. This configuration applies to the main HTTPS listeners of the PingFederate server.

A. Supported ciphers are configured using a different property, typically pf.engine.ssl.ciphers.

B. The HTTPS port is configured using the pf.https.port property.

D. This property affects all engine listeners, not just clustering; specific clustering communication settings are managed elsewhere.

---

1. Ping Identity PingFederate Documentation, Server Administration > System Services > Configuring protocols and cipher suites. This section explicitly states: "To specify the protocols for the PingFederate runtime-engine listeners, edit the pf.engine.ssl.protocols property in the /pingfederate/bin/run.properties file."

2. Ping Identity PingFederate Documentation, Installation > Pre-installation planning > System requirements > Java virtual machine options. The documentation notes that the JVM's enabled protocols can be a limiting factor, but PingFederate's specific protocol configuration is managed in run.properties via pf.engine.ssl.protocols.

3. Ping Identity Knowledge Base, Article 000030400, How to change the default TLS protocol version of PingFederate. This official support article guides administrators to "Modify the pf.engine.ssl.protocols parameter in the /pingfederate/bin/run.properties file" to control the enabled TLS versions.