IBM Support

Limitng ciphers is breaking connections to monitored server

Troubleshooting


Problem

Adjusting the CC_java.security in conf directory of Control Center to remove insecure ciphers from being used breaks the connection to the monitored B2B server.
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, DSA, MD5, DH, ECDH, MD5withRSA, DH keySize < 1024, DESede, \
   EC keySize < 224, 3DES_EDE_CBC, anon, NULL, DES_CBC, \
    SSL_RSA_WITH_AES_128_CBC_SHA, \
    SSL_RSA_WITH_AES_128_CBC_SHA256, \
    SSL_RSA_WITH_AES_128_GCM_SHA256, \
    SSL_RSA_WITH_AES_256_CBC_SHA, \
    SSL_RSA_WITH_AES_256_CBC_SHA256, \
    SSL_RSA_WITH_AES_256_GCM_SHA384

Symptom

Showing the following error in the logs
No appropriate protocol (protocol is disabled or cipher suites are inappropriate)

Cause

A left over engine.properties from 6.1.3.0 and previous releases was still present
https.cipherSuites=TLS_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_RC4_128_MD5
this was causing problems with the server connections.

Diagnosing The Problem

Review the settings in CC_java.security and in engine.properties along with the error messages in the logs.

Resolving The Problem

Remove the line in the engine.properties for https.cipherSuites using System Settings>Properties>engine.properties from the Control Center Web Console.
In future fixes for Control Center the https.cipherSuites will be ignored and will show this in the Engine log.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB59","label":"Sustainability Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSJC3O","label":"IBM Sterling Control Center Monitor"},"ARM Category":[{"code":"a8m0z000000cwVyAAI","label":"ENGINE"}],"ARM Case Number":"TS011987682","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.2.0;6.2.1;6.3.0"},{"Type":"MASTER","Line of Business":{"code":"LOB59","label":"Sustainability Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSNG8A","label":"IBM Sterling Control Center Director"},"ARM Category":[{"code":"a8m0z000000cwVyAAI","label":"ENGINE"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.2.0;6.2.1;6.3.0"}]

Document Information

Modified date:
30 March 2023

UID

ibm16967331