How to Enable TLS 1.3 for AAI Inbound HTTPS Listener

Products

• Automation Analytics & Intelligence

Issue/Introduction

This article outlines the steps to configure the Automation Analytics & Intelligence (AAI) server to support TLS 1.3 for inbound HTTPS connections on port 8443, as the default configuration may only support TLS 1.2.

Problem: When attempting to connect to the AAI server via port 8443 using TLS 1.3, the connection is rejected with an SSL alert number 70, while TLS 1.2 connections function correctly.

Environment

• Product: Automation Analytics & Intelligence (AAI)
• Component: JBoss Application Server
• Protocol: TLS 1.3

Resolution

 To enable TLS 1.3, update the standalone.xml configuration file to explicitly include the protocol.

1. Locate the Configuration File: Navigate to the AAI JBoss configuration directory: /opt/CA/AAI/jboss/standalone/configuration/standalone.xml

2. Update the Server SSL Context: Locate the <server-ssl-context> element within the file. Modify the entry to include the protocols attribute. Ensure the configuration reflects the following structure:

   xml

   <server-ssl-contexts>    <server-ssl-context        name="applicationSSC"        key-manager="applicationKM"        protocols="TLSv1.3 TLSv1.2"        cipher-suite-names="TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-RSA-AES256-GCM-SHA384" /></server-ssl-contexts>

   Note: Adjust cipher-suite-names according to your specific security policy requirements.

3. Restart AAI/JBoss: Restart the AAI service to apply the configuration changes.

4. Verify Configuration: Run the following OpenSSL command to confirm the server is successfully negotiating TLS 1.3: echo | openssl s_client -connect localhost:8443 -tls1_3

   The output should confirm the connection with: Protocol : TLSv1.3