VSphere Replication 8.x - Turn off TLS 1.1 on port 443
book
Article ID: 338473
calendar_today
Updated On:
Products
VMware Live RecoveryVMware vSphere ESXi
Issue/Introduction
To disable TLS 1.1 and only leave TLS 1.2 enabled on port 443
Symptoms: Due to stricter security requirements for some customers, TLS 1.1 may need to be disabled on port 443 for the VSphere Replication Appliances
Environment
VMware vSphere Replication 8.x
Resolution
1. Connect to the vSphere Replication appliance via SSH. Open Apache Tomcat configuration file with a text editor (I would actually use WinSCP to copy the file out for edit unless you are familiar with VI): vi /var/opt/apache-tomcat/conf/server.xml
2. Look for a 'Connector' tag that defines a tomcat connector responding on address="::" and port="8443". It should also have a 'SSLHostConfig' tag as a child. For example it should look like:
In the SSLHostConfig xml tag look for an argument named 'protocols' this is what defines the supported TLS versions. For example 'TLSv1.1+TLSv1.2' means that TLS 1.1 and TLS 1.2 are both supported and can be used for connection. To only allow TLS 1.2 set the value to 'TLSv1.2'.
3. After modifying server.xml file you need to restart tomcat service:
service tomcat restart
Additional Information
Impact/Risks: Note: Take a snapshot of the vSphere Replication appliance prior to working with this KB