Unable to connect to Protection Engine using the Java SDK via secure ICAP

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

You are unable to connect to the Symantec Protection Engine (SPE) via secure ICAP using an application you've written using the Java SDK.  Your application may report one or more of the following errors

Unable to communicate with Symantec Protection Engine.

ERROR_SOCKET_COMMUNICATION

Attempt to Connect to Symantec Protection Engine failed.

 

A review of the SPE's SSEYYYYMMDD.log file shows entries similar to the following:

Failed to complete TLS/SSL handshake initiated by TLS/SSL client. Error code: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher

Environment

SPE 9.x

Cause

There are no ciphers shared between the application and the SPE server.

Resolution

Ensure that the SPE server and the application have at least one common cipher. 

Please note, when adding ciphers into an application you've written using the SPE's Java SDK, the ciphers must be in IANA format.  Additionally, when entering ciphers into the SPE's configuration.xml (via xmlmodifer) they must be in openSSL format.  Several 3rd party sites (including https://ciphersuite.info/) exist that can help map openSSL format to IANA format and vice versa.