websphere probe can't connect to WAS server via TLS 1.0: ConnectorException: ADMC0016E

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

The websphere probe cannot connect to TLS 1.0 WAS server:

 

There is no connectivity to the resource for  xxxxxxxx:8880
Not able to get certificate, reason: javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS10 is not accepted by client preferences [TLS12]:

The error is similar using "ssl = yes" or "ssl = NO"

Feb 23 11:32:14:801 [nimclient, websphere] connect; xxxxxxxx:8880,SOAP,wasadmin/B3ZxxxxxxxxxxxxA==,false,true
Feb 23 11:32:14:915 [nimclient, websphere] (1500) , Not able to get certificate, reason: javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS10 is not accepted by client preferences [TLS12]: The server selected protocol version TLS10 is not accepted by client preferences [TLS12]
Feb 23 11:32:14:918 [nimclient, websphere] vendor=ibm corporation
Feb 23 11:32:14:918 [nimclient, websphere] Trying SOAP JMX (xxxxxxxx:8880)
Feb 23 11:32:14:918 [nimclient, websphere] Found SSL
Feb 23 11:32:14:918 [nimclient, websphere] trust store
Feb 23 11:32:15:279 [nimclient, websphere] Error in cbFindEntities, reason: (1500) , Connection problem, reason: com.ibm.websphere.management.exception.ConnectorException: ADMC0016E: The system cannot create a SOAP connector to connect to host xxxxxxxxat port 8880.: ADMC0016E: The system cannot create a SOAP connector to connect to host xxxxxxx at port 8880.

Environment

• Release: UIM 20.4, websphere probe 1.83
• WAS Version is 8.5.5.15
• OS where probe is deployed: Linux

 

Cause

• missing protocol definition in probe configuration

Resolution

Add protocols as below:

1. Open the probe raw configure

2. In the <startup><opt> section create "New Key" key and assign the below value: 

Key: -Dhttps.protocols

Value: TLSv1.2,TLSv1.1,TLSv1,SSLv3

3. Restart the probe and test again

<startup>
   <opt>
       java_mem_max = -Xmx128m
       java_mem_init = -Xms32m
      -Dhttps.protocols = TLSv1.2,TLSv1.1,TLSv1,SSLv3
   </opt> 
</startup>

Note that as of the current websphere GA probe version 1.85, TLSv1.3 is not supported.

Additional Information

ADMC0016E: The System Cannot Create a SOAP Connector