Unable to register to a Task Server if only TLS 1.2 is enabled in the environment

Products

• IT Management Suite
• Client Management Suite

Issue/Introduction

The customer disabled TLS 1.0 and 1.1. After that, client machines and the Task Server itself can't register since TLS 1.2 is the only allowed protocol.

Messages like these are noticed while the client machine tries to register to the Task Server:

Entry 1:

Path: /Altiris/ClientTaskServer/Register.aspx 
Id: 8.5312 
Error type: Network error 
Error code: An established connection was aborted by the software in your host machine (10053) 
Error note: SocketIOStrategySyncSelect::Send error 

Entry 2:

Failed to call web interface by url [https://TaskServer01.yourdomain.com:443/Altiris/ClientTaskServer/Register.aspx?resourceGuid=<guid>&crc=0008000000000EB9], error [0x80072745, An established connection was aborted by the software in your host machine.].

Entry 3:

Could not register using "https://TaskServwer01.yourdomain.com:443/Altiris/ClientTaskServer/Register.aspx"

Entry 4:

An attempt to register on Task Server [TaskServer01.yourdomain.com] over [https] completed with status [FAILED (may retry)].

 

Entry 1:

Operation 'Direct: Post' failed. 
Protocol: HTTPS 
Host: TaskServer01.yourdomain.com:443 
Path: /Altiris/ClientTaskServer/Register.aspx 
Id: 8.5312 
Error type: Network error 
Error code: An established connection was aborted by the software in your host machine (10053) 
Error note: SocketIOStrategySyncSelect::Send error 
Server HTTPS connection info: 
   Server certificate: 
      Serial number: 07 15 9e 7a fc 9f b8 c5 bd b0 eb f2 db a1 05 b8 
      Thumbprint: bf 68 c7 4c b8 5f 40 10 b5 9d 83 dc ec 13 21 42 d3 63 0c 5f 
   Cryptographic protocol: TLS 1.2 
   Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521 
   Cipher algorithm: AES 
   Cipher key length: 256 
   Hash algorithm: SHA384 
   Hash length: 384 
   Key exchange algorithm: ECDH_P521 
   Key length: 521
-----------------------------------------------------------------------------------------------------
Process: AeXNSAgent.exe (5312), Thread ID: 5604, Module: AeXNetComms.dll
Priority: 1, Source: NetworkOperation

Entry 2:

Failed to call web interface by url [https://TaskServer01.yourdomain.com:443/Altiris/ClientTaskServer/Register.aspx?resourceGuid=<guid>&crc=0008000000000EB9], error [0x80072745, An established connection was aborted by the software in your host machine.].
-----------------------------------------------------------------------------------------------------
Process: AeXNSAgent.exe (5312), Thread ID: 5604, Module: client task agent.dll
Priority: 2, Source: Client Task Agent

Entry 3:

Could not register using "https://TaskServer01.yourdomain.com:443/Altiris/ClientTaskServer/Register.aspx"
-----------------------------------------------------------------------------------------------------
Process: AeXNSAgent.exe (5312), Thread ID: 5604, Module: client task agent.dll
Priority: 2, Source: Client Task Agent

Entry 4:

An attempt to register on Task Server [TaskServer01.yourdomain.com] over [https] completed with status [FAILED (may retry)].
-----------------------------------------------------------------------------------------------------
Process: AeXNSAgent.exe (5312), Thread ID: 5604, Module: client task agent.dll
Priority: 4, Source: Client Task Agent

Environment

ITMS 8.x

Cause

This is a Microsoft configuration. There are certain places in the registry that sometimes need to be modified to force TLS 1.2 to be the only one in use.

See:
https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls
https://support.microsoft.com/en-us/help/3155464/ms16-065-description-of-the-tls-ssl-protocol-information-disclosure-vu

Resolution

There is a TLS mismatch between what the client OS supports, and what the server OS supports.

IISCrypto can be downloaded from Nartac Software.  IISCrypto can be used to set TLS and all Cipher Suites desired for any Windows Operating system with out having to navigate the Registry and make multiple updates.  It is a very useful tool.  Make sure the system is rebooted to complete the change. 

HINT: Black check marks are better than gray check boxes, as black indicates the option is set and enabled.  Gray means OS default (could be Disabled or Enabled), which is a research project.

Additional Information

For additional information, see Disabling TLS 1.0 breaks Task Management functionality