Hubs disconnected after upgrade from 23.4.3 to 23.4.8 or later (DX UIM)
Article ID: 458565
Updated On:
Products
Issue/Introduction
Problem: After upgrading the DX UIM environment from 23.4.3 to 23.4.9, multiple hubs appear disconnected or "disappeared" from the Infrastructure Manager / Admin Console. Primary hub is tunnel clients for Remote hubs which are Tunnel Servers.
The hub.log file on the primary or affected hubs indicates a handshake failure due to weak signature algorithms: SSL error with certificate at depth 0 error: CA signature digest algorithm too weak (68)
How do I reestablish the connectivity?
Environment
DX UIM 23.4.7 and later
Cause
Starting with DX UIM 23.4.7, SSL tunnel communication requires SHA-384 hashing algorithms for all tunnel certificates. Certificates generated prior to 23.4.0 typically use SHA-1. When upgrading directly from 23.4.3 to 23.4.9, the hub strictly enforces this security policy, causing all existing SHA-1 tunnel connections to fail.
Resolution
In this Scenario, the primary hub is upgraded to 23.4.8 or later while remote hubs are still running on hub 23.4.3 Version.
Immediate Workaround (Restore Connectivity):
- Navigate to the
hubprobe folder on the affected hubs. - Edit the
hub.cfgfile (or use Raw Configure). - Under the
<hub>section, add:enable_cert_compatibility = yes. - Save the configuration and restart the hub probe. This will allow the hubs to accept the legacy SHA-1 certificates.
Permanent Remediation (Security Best Practice):
- Once connectivity is restored, identify all SHA-1 certificates using the validation steps in .
- Re-create the Tunnel Server CA and re-issue all client certificates to ensure the environment is using SHA-384.
- After all certificates have been replaced, remove the
enable_cert_compatibility = yesparameter from thehub.cfgto enforce the higher security standard.
Additional Information
Feedback
