Unable to use Bluecoat proxy server to send metrics to SaaS

Products

• CA Application Performance Management (APM / Wily / Introscope)

Issue/Introduction

Logs attached, shows 

 [WARN] [IntroscopeAgent.ConnectionThread] Failed to connect to the Introscope Enterprise Manager at example.com:443,com.wily.isengard.postofficehub.link.net.HttpsTunnelingSocketFactory (com.wily.isengard.postofficehub.link.http.client.HTTPNotRunningException:The HTTP Tunneling server cannot be reached at: https://example.com:443/em/transport/services/IsengardHttpTunnelingService: Error when connecting to tunneling server: status=403).
 [ERROR] [IntroscopeAgent.IsengardMessaging] WebSocket Client caught io.netty.handler.proxy.ProxyConnectException: http, none, /<ip_address>:8080 => example.com/##.##.##.##:443, status: 403 Forbidden
 [ERROR] [IntroscopeAgent.IsengardMessaging] WebSocket connection attempt timed out: wss://example.com:443/transport/socket
9/20/22 11:42:31 AM EDT [WARN] [IntroscopeAgent.ConnectionThread] Failed to connect to the Introscope Enterprise Manager at example.com:443,com.wily.isengard.client.transport.websocket.SSLWebSocketFactory (java.io.IOException:WebSocket connection attempt timed out: wss://example.com:443/transport/socket).

 [INFO] [IntroscopeAgent.InfrastructureAgent] SSL socket factory configured cipher SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 is not supported by JVM
 [INFO] [IntroscopeAgent.InfrastructureAgent] Setting SSL socket ciphers to: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384]
 [WARN] [IntroscopeAgent.ConnectionThread] Failed to connect to the Introscope Enterprise Manager at example.com:443,com.wily.isengard.postofficehub.link.net.HttpsTunnelingSocketFactory (com.wily.isengard.postofficehub.link.http.client.HTTPNotRunningException:The HTTP Tunneling server cannot be reached at: https://example.com:443/em/transport/services/IsengardHttpTunnelingService: Error when connecting to tunnel

 

Resolution

So looks like you had SSL cipher suite enabled

SSL socket factory configured cipher SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is not supported by JVM
 [INFO] [IntroscopeAgent.InfrastructureAgent] SSL socket factory configured cipher SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is not supported by JVM
 [INFO] [IntroscopeAgent.InfrastructureAgent] SSL socket factory configured cipher SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 is not supported by JVM

But ends up using 

Setting SSL socket ciphers to: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384]

Then fails 
[WARN] [IntroscopeAgent.ConnectionThread] Failed to re-connect to the Introscope Enterprise Manager at example.com:443,com.wily.isengard.postofficehub.link.net.HttpsTunnelingSocketFactory (java.net.ConnectException:Connection timed out (Connection timed out))., TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384]
WARN] [IntroscopeAgent.ConnectionThread] Failed to re-connect to the Introscope Enterprise Manager at example.com:443,com.wily.isengard.postofficehub.link.net.HttpsTunnelingSocketFactory (java.net.ConnectException:Connection timed out (Connection timed out)).

Check Blue Coat Firewall rules and if The cipher suites are set both on Agent and EM

 

===
To turn on SSL debugging, add to JVM arguments. This is for EM. But same idea applies to Agent

Troubleshooting with SSL Trace
To get more details on TLS connection negotiation you can activate the standard Java SSL tracing. For this purpose add the Java VM parameter -Djavax.net.debug like below  

-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager

or

-Djavax.net.debug=all:

On Windows add a new line to bin\EMService.conf:

EMService.conf
wrapper.java.additional.8=-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager