## 5 Evaluation Approach
### Analysis of Feature Models and Diagnosis of Configurations
In the case of _Apache_ configurations (cf., Table 4), the protocol version has not been specified in the first wrong configuration, and the suggested diagnosis is to select a specific version of the protocol. \begin{table}
\begin{tabular}{c l c c} \hline \hline \# & **Configuration** & **Result** & **Diagnosis** \\ \hline \multirow{2}{*}{1} & Apache, Protocol, TLSv1.1, KeyStore, K\_File, K\_Pass, K\_Type, & **Valid** & - \\  & PKCS11, ClientAuth, false, Port & & **Valid** & - \\ \hline \multirow{2}{*}{2} & Apache, Protocol, TLSv1.2, KeyStore, K\_File, K\_Pass, K\_Type, & **Valid** & - \\  & Ciphers, Algorithm, ClientAuth, want, Port, PCKS12 & & **Valid** & - \\ \hline \multirow{2}{*}{3} & Apache, Protocol, KeyStore, K\_File, K\_Pass, K\_Type, ClientAuth, & **No valid** & **Select**: TLSv1, TLSv1.2, TLSv1.1, TLSv1.3 \\ \hline \multirow{2}{*}{4} & Apache, Protocol, TLSv1.2, KeyStore,K\_File, K\_Pass, K\_Type, & **No valid** & **Select**: TLSv1, TLSv1.3 \\ \hline \multirow{2}{*}{5} & Apache, Protocol, TLSv1.2, KeyStore,K\_File, K\_Pass, K\_Type, & **No valid** & **Select**: TSV1, TLSv1.2, TLSv1.1, TLSv1.3 \\ \hline \multirow{2}{*}{6} & Apache, Protocol, TLSv1.2, KeyStore,K\_File, K\_Pass, & **No valid** & **Select**: \\  & ClientAuth, Port, Algorithm, Ciphers & & **No valid** \\  & & & \\ \hline \multirow{2}{*}{5} & Apache, ClientAuth, false, Port, Keystore, K\_File, K\_Pass, & **No valid** & **No valid** \\  & K\_Type, PKCS7, Protocol, TLSv1.3 & & **PKCS12** \\  & & & **Deselect**: PKCS7 \\ \hline \multirow{2}{*}{6} & Apache, Ciphers, ClientAuth, want, Keystore, K\_File, K\_Pass, & **No valid** & **Select**: Port \\  & K\_Type, PKCS12, Protocol, TLSv1.3 & & **No valid** & **Select**: Port \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Diagnosis of _Apache_ model configurations. \begin{table}
\begin{tabular}{c l c} \hline \hline \# & **Configuration** & **Result** & **Diagnosis** \\ \hline \multirow{2}{*}{1} & SSL/ TLS, Protocol, TLSv1.2, KeyExchange, DHE, CipherSuite, & **Valid** & - \\  & Cipher, AES\_128\_GCM, MAC, SHA256, Authentication, ECDSA, & **Valid** & - \\  & Methods, KeySize, 3072, SessionResumption & & **Valid** & - \\ \hline \multirow{2}{*}{2} & SSL/ TLS, Protocol, TLSv1.2, CipherSuite, Cipher, AES\_128\_CCM, & **Valid** & - \\  & Authentication, ECDSA, KeyExchange, DHE, MAC, SHA512, & **Valid** & - \\  & Methods, KeySize, 3072, SessionResumption & & **Select**: RSA\_Auth, DHE \\  & SHA512, Methods, KeySize, 3072, SessionResumption & & **Deselect**: DHE \\ \hline \multirow{2}{*}{4} & SSL/ TLS, Protocol, CipherSuite, MAC, SHA384, Authentication, & **Select**: ECDSA, Cipher, AES\_256\_GCM, KeyExchange, DHE, Methods, KeySize, 4096, SessionResumption & **No valid** & **Select**: TLSv1.2, TLSv1.3 \\ \hline \multirow{2}{*}{5} & SSL/ TLS, CipherSuite, KeyExchange, SRP, Authentication, & **Select**: DHE \\  & RSA\_Auth, Cipher, AES\_128\_CCM, MAC, SHA512, & **No valid** & **Deselect**: DHE \\  & SessionResumption, Protocol, TLSv1.2, Methods, KeySize, 8192 & & **Select**: SRP \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Diagnosis of _SSL/TLS_ model configurations. In the second wrong configuration, the type of _ClientAuth_ has not been indicated. In this case, you cannot select _true_ because it would imply the selection of the _Trust_ feature, so the suggested diagnosis is to select between the options _want_ or _false_. In the case of the third invalid configuration, _PKCS7_ has been chosen as the format of the certificate keystore. This configuration is invalid because, as indicated in the Apache Tomcat documentation, the current version of Apache Tomcat only works with the _JKS_, _PKCS11_ and _PKCS12_ keystorage formats. In fact, the configuration diagnosis indicates that in order to correct the configuration, the chosen format must be deselected and one of the three previously mentioned must be selected.