Invalid TLS Protocol Version Chosen: TLSv1.1 - Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

After applying TLS 1.2 remediation, the im_ps.log file may report an error indicating an invalid TLS protocol version is chosen. This prevents communication between the Provisioning Server (IMPS) and Identity Manager (IM).
The following error appears in the logs: Invalid TLS protocol version is chosen: TLSv1.1. So, TLSv1, TLSv1_1 and TLSv1_2 enabled by default

Environment

 Identity Manager 14.x Component: Provisioning Server

Cause

This issue is typically caused by:

• An incorrect TLSProtocolMin value in the configuration file.
• The configuration file not being parsed correctly after manual modification.

Resolution

1. Locate the im_ps.conf file under the ProvisioningServer/data directory.
2. Search for the entry TLSProtocolMin.
3. Change the value from TLSv1.1 to TLSv1_2.
4. If the issue persists despite the correct declaration, perform the following steps to toggle the setting: a. Change TLSv1_2 back to TLSv1_1. b. Save the file. c. Change it back to TLSv1_2 and save again to ensure the file reader registers the change.

Note: For Virtual Appliance (vApp) environments, ensure you perform these actions as the imps user (su - imps).

Additional Information

• For instructions on how to retrieve logs, please refer to product documentation.
• To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.