Policy Manager Fails When Disabling TLS 1.0 On Listen Port

Products

• CA API Gateway

Issue/Introduction

When disabling TLS 1.0 on a listen port and then attempting to launch policy manager while connecting on that specific port it will fail with the following error:

The SSL/TLS handshake with the Gateway has failed

Environment

API Gateway

Cause

By default, the policy manager application will only attempt to connect to the gateway over TLS 1.0.

Resolution

Force the policy manager application to connect to the gateway using TLS 1.2 as follows:

 

• Make a backup copy of and then edit the "Layer 7 Policy Manager.ini" file on the server policy manager is being launched from for the version of the gateway you are connecting to. For example, it might be located here:
  • C:\Program Files (x86)\CA Technologies - A Broadcom Company\Layer7 API Gateway Policy Manager <version#>\Layer 7 Policy Manager.ini
• Add this to the "commandline" line:
  • -Dhttps.protocols=TLSv1.2
• Save the edited file.
• Make a backup copy of and then edit the "Layer 7 Policy Manager.bat" file on the server policy manager is being launched from for the version of the gateway you are connecting to. For example, it might be located here:
  • C:\Program Files (x86)\CA Technologies - A Broadcom Company\Layer7 API Gateway Policy Manager <version#>\Layer 7 Policy Manager.bat
• Add this to the "@jre\bin\java" line:
  • -Dhttps.protocols=TLSv1.2
• Save the edited file.
• Restart the policy manager and it should now successfully connect to the gateway.