SSL connection error for ASM monitors
Article ID: 392800
Updated On:
Products
Issue/Introduction
We are receiving SSL connection error for some ASM monitors
Environment
DX ASM SaaS
Cause
The problem is not in the ciphers, the problem is in the protocol. The server is supporting TLS v1.0 only. This version was created in 1999 and in 2019 it has been deprecated as it is not secure. Even the next version TLS v1.1 has already been deprecated in 2019-2020. The next version TLS v1.2 has been in use since 2008 (i.e. 15 years) and is still supported. However, the latest version is TLS v1.3 which has been introduced in 2018, i.e. 5 years ago. The removal of the obsolete protocols was expected a long time ago.
Resolution
Upgrade Client Appserver side with latest supported ciphers : enable TLS v1.2 or TLS v1.3
For more information about these protocols and the security issues read this article
NOTE: We have already ran into a problem where the server rejected connection if our system suggested deprecated or weak protocol or cipher. The SSL handshake is interrupted by such servers only because we say "we can use TSL1.0, TLS 1.1, TLS 1.2 and TLS 1.3 - pick the protocol you want". Our agents must only say "we support only TLS 1.3". Otherwise, the connection is simply closed without any explanation and connection fails. Browsers, do some magic - reconnecting with different configurations if the connection is interrupted in this way but is is browser specific and cannot be relied upon that.
Additional Information
Feedback
