topic Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605) in IMC

Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

denn93 — Thu, 24 May 2018 15:35:44 GMT

Hello!

after upgrade to iMC PLAT v7.3 (E0605) the imc is not working anymore.

i only got this error:

This page can't be displayed

Make sure the web address https://imc.ad.local:8443 is correct.

Look for the page with your search engine.

Refresh the page in a few minutes.

Make sure TLS and SSL protocols are enabled. Go to Tools > Internet Options > Advanced > Settings > Security

I i check in the Deployment agent Monitor everything is green and can not see any errors. I did not get any errors when uppdating IMC to the latest version.

Some have any ides?

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

LindsayHill — Thu, 24 May 2018 18:21:11 GMT

Check to see if your server is listening on port 8443 (or port 443) using netstat.

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

denn93 — Fri, 25 May 2018 11:50:22 GMT

the server is litsning on the port. but only gets the answer ERR_SSL_VERSION_OR_CIPHER_MISMATCH .

if i use 8080 and http i can reach imc and use the system.

only get errors when trying on HTTPS.

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

LindsayHill — Sat, 26 May 2018 21:20:23 GMT

You'll need to investigate your server & browser combination more closely, to figure out why they can't agree. You could start by trying another browser, and using "openssl s_client" to look at what ciphers & SSL versions the server is offering, and from there figure out why your browser doesn't like those.

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

CCTobias — Tue, 29 May 2018 15:42:47 GMT

100% exactly the same behaviour here

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

mschrein2 — Thu, 31 May 2018 07:38:09 GMT

the problem is with the $IMC/client/conf/server.xml file (this is the file which defines the http and https connectors), it is missing the ciphers for https

please open a case with hpe to get a working one

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

mschrein2 — Thu, 31 May 2018 07:47:52 GMT

this is how the server.xml file should look like:

<?xml version="1.0" encoding="utf-8" standalone="no"?><Server port="8005" shutdown="SHUTDOWN">

   
   <Listener SSLEngine="on" className="org.apache.catalina.core.AprLifecycleListener"/>
   <Listener className="org.apache.catalina.core.JasperListener"/>
   <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
   <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
    <Listener className="com.h3c.imc.traceLog.iMCTraceWebListener"/>

   
   <Service name="Catalina">

       
       <Connector URIEncoding="UTF-8" acceptCount="100" compressableMimeType="text/html,text/xml,text/xhtml,text/css,text/javascript,text/plain" compression="on" compressionMinSize="2048" connectionTimeout="60000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxPostSize="5242880" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" noCompressionUserAgents="gozilla, traviata" port="8080" protocol="org.apache.coyote.http11.Http11NioProtocol" redirectPort="8443" server="Server" useURIValidationHack="false"/>

       
       <Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" clientAuth="false" compressableMimeType="text/html,text/xml,text/xhtml,text/css,text/javascript,text/plain" compression="on" compressionMinSize="2048" connectionTimeout="60000" disableUploadTimeout="true" enableLookups="false" keystoreFile="security/newks" keystorePass="iMCV500R001" maxHttpHeaderSize="8192" maxPostSize="5242880" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" noCompressionUserAgents="gozilla, traviata" port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" server="Server" sslProtocol="TLS"/>

       
       
       

       
       <Engine defaultHost="imcHost" name="imcEngine">

           
           <Host appBase="web/apps" autoDeploy="false" name="imcHost" server="Server" startStopThreads="10" unpackWARs="true" workDir="web/work">

               
               

           </Host>
       </Engine>
   </Service>
</Server>

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

denn93 — Thu, 31 May 2018 08:06:30 GMT

I installed a new imc server to solve the problem.

on the old server i add the:

<Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" clientAuth="false" compressableMimeType="text/html,text/xml,text/xhtml,text/css,text/javascript,text/plain" compression="on" compressionMinSize="2048" connectionTimeout="60000" disableUploadTimeout="true" enableLookups="false" keystoreFile="security/newks" keystorePass="iMCV500R001" maxHttpHeaderSize="8192" maxPostSize="5242880" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" noCompressionUserAgents="gozilla, traviata" port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" server="Server" sslProtocol="TLS"/>

server.xml and now it works.

On the new server the ciphers is in the server.xml . So looks like this problem coming up when updating to the (E0605).

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

EMachabert — Thu, 31 May 2018 11:48:10 GMT

Adding the CIPHER suite does the trick.

I would add that while you are editing this file you could enhance the security by disabling Poodle attack vector by adding this parameter:

sslEnabledProtocols="TLSv1.1,TLSv1.2"

see CVE-2014-3566 https://support.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0123277

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

spgsitsupport — Wed, 20 Feb 2019 13:20:00 GMT

Done the line as per above to:

C:\Program Files\iMC\client\conf\server.xml

		<Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" clientAuth="false" compressableMimeType="text/html,text/xml,text/xhtml,text/css,text/javascript,text/plain" compression="on" compressionMinSize="2048" connectionTimeout="60000" disableUploadTimeout="true" enableLookups="false" keystoreFile="security/newks" keystorePass="iMCV500R001" maxHttpHeaderSize="8192" maxPostSize="5242880" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" noCompressionUserAgents="gozilla, traviata" port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" server="Server" sslProtocol="TLS"/>

C:\Program Files\iMC\client\security\newks is correct file with CORRECT certificate (which was working fine before upgrade)

But Chrome only gives me now: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

spgsitsupport — Tue, 30 Mar 2021 12:10:30 GMT

Anybody?

I still only get:

This site can’t provide a secure connectionhpimc.spgs.org uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH Unsupported protocol The client and server don't support a common SSL protocol version or cipher suite.

Re: Login page SSL error after upgrade to iMC PLAT v7.3 (E0605)

spgsitsupport — Fri, 09 Apr 2021 14:33:30 GMT

Had to add cipher

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

because I am using ECDSA_P256 certificate

Way better list of ciphers is here:

https://www.jamf.com/jamf-nation/articles/384/configuring-supported-ciphers-for-tomcat-https-connections

ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"