TLS protocol configuration options for vSphere Replication 8.x
search cancel

TLS protocol configuration options for vSphere Replication 8.x

book

Article ID: 317496

calendar_today

Updated On:

Products

VMware Live Recovery VMware vSphere ESXi

Issue/Introduction

In vSphere Replication 8.1, 8.2, and 8.3, the TLS protocol versions, 1.1, and 1.2 are enabled by default. The purpose of this article is to guide a customer through modifying the TLS protocols on the individual services of vSphere Replication.

Environment

VMware vSphere Replication 8.x

Resolution

To disable TLSv1.1 use the following steps.

 

ServicePortConfiguration steps
Configuration steps for vSphere Replication Management Service (hms)8043Configuration steps for hms service.
Configuration steps for vSphere Replication service (hbrsrv)8123Configuration steps for hbrsrv service.
Configuration steps for VMware Virtual Appliance Management Interface (VAMI)5480Configuration steps for vami service.
Configuration steps for Site Recovery UI443Configuration steps for Site Recovery UI


NOTE: Always make a backup copy of the configuration file before you start editing.


Configuration steps for vSphere Replication Management Service - port 8043
  1. Log in to the vSphere Replication appliance using PuTTY.
  2. Open the file /opt/vmware/hms/conf/hms-configuration.xml in an editor and change the value of hms-ssl-enabled-protocols to TLSv1.2.
  3. Save the file.
  4. Restart hms service.
service hms restart


Configuration steps for vSphere Replication service - port 8123
  1. Log in to vSphere Relication Appliance and vSphere Replication Server using PuTTY.
  2. Open the file /etc/vmware/hbrsrv.xml in an editor, locate the tag <vmacore><ssl> and add <sslOptions>386023424</sslOptions> in to disable TLSv1.1
    <vmacore> <ssl> <sslOptions>117587968</sslOptions> </ssl> </vmacore>
  3. Save the file.
  4. Restart the service.
service hbrsrv restart
 
SSL/TLS ProtocolsValue
Disable SSLv3 + Disable TLSv1.0117587968
Disable SSLv3 + Disable TLSv1.0 + Disable TLSv1.1386023424
Re-Enable all versions of TLS (1.0,1.1 and 1.2)50479104

Configuration steps for VMware Virtual Appliance Management Interface (VAMI) - port 5480
  1. Go to /opt/vmware/etc/lighttpd/lighttpd.conf.
  2. Create a backup copy of the file.
  3. Open the file in an editor and search for the ssl.use-tlsv11.
  4. To disable TLS 1.1 make sure that: ssl.use-sslv2, ssl.use-tlsv10, ssl.use-tlsv11 properties are all having a value of "disable" and ssl.use-tlsv12 have a value of "enable".
Configuration steps for Site Recovery UI - Port 443

Site Recovery UI runs in an Apache Tomcat server and to change the supported TLS version perform the following steps on an HMS appliance:
  1. Open Apache Tomcat configuration file with a text editor.
vi /var/opt/apache-tomcat/conf/server.xml
  1. Look for a 'Connector' tag that defines a tomcat connector responding on address="::" and port="8443". It should also have a 'SSLHostConfig' tag as a child. For example it should look like:
<Connector SSLEnabled="true" Secure="true" address="::" maxThreads="150" port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol">
   <SSLHostConfig ciphers="!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES" protocols="TLSv1.2">
      <Certificate certificateKeystoreFile="lib/hms-keystore.jks" certificateKeystorePassword="H55MSDVcNUdsAwlP" type="RSA" />
   </SSLHostConfig>
</Connector>
In the SSLHostConfig xml tag look for an argument named 'protocols' this is what defines the supported TLS versions. For example 'TLSv1.1+TLSv1.2' means that TLS 1.1 and TLS 1.2 are both supported and can be used
for connection. To only allow TLS 1.2 set the value to 'TLSv1.2'.
  1. After modifying server.xml file you need to restart tomcat service.
service tomcat restart