OneView for vCenter - Disable TLS 1.0/1.1

[msobers22]

Hello,

The OneView for vCenter (OV4VC) appliance is getting flagged by security for TLS vunerabilites. DO anyone know how to disable TLS version 1.0 and 1.1 on the appliance. The user guide is no help. 

Thanks in advance

[support_s]

System recommended content:

1. HPE OneView for VMware vCenter 11.1.0 Installation Guide | HPE OneView for VMware vCenter compatibility matrix

2. HPE OneView for VMware vCenter 11.1.0 User Guide | HPE OneView for VMware vCenter integration with VMware vSphere Lifecycle Manager

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[ChrisLynch]

What version of the OV4VC appliance are you using?

[msobers22]

Version 11.2

[ChrisLynch · Accepted solution]

[UPDATED]

Thanks.  I verified with our R&D team that the OneView for VMware vCenter (OV4VC) 11.2 10.3 is the last release to support both TLS 1.0 and 1.1.  You need to update the appliance to 11.3  10.3 or newer in order to for the use of TLS 1.2.  TLS 1.0 and 1.1 are both deprecated and removed when you have OV4VC 10.3 or newer deployed.

Since you have reported the OV4VC appliance is at 11.2, I have some follow up questions:

• What tool did you use to verify this? 
• What port(s) did you "scan"? 
• Does the IP or FQDN (as resovled IP address) match that of the OV4VC appliance?

[msobers22]

Hi @ChrisLynch,

Thatnks for the reply. The enviroment with the OV4VC belongs to a customer. I have no idea what scanning software was used to flag the vulnerability.

I just looked at your reply again, so are you sayingh that OV4VC ver 11.2 shouldn't have TLS 1.0 or 1.1 installed at all?

I will ask my customer about the ports and scanning tool.     

Thanks

//MS

[ChrisLynch]

I just looked at your reply again, so are you sayingh that OV4VC ver 11.2 shouldn't have TLS 1.0 or 1.1 installed at all?

Correct.  Which is why I'm asking the follow up questions.  TLS 1.0 and 1.1 should not be available, as we actively disabled those TLS versions.  The OV4VC appliance does not have any configuration options to enable or disable TLS versions.

[msobers22]

Hey @ChrisLynch 

I finally got the rest of the story from the client. He actually has two instances of OV4VC running inhis environment. The instance that alerted in the security scan is running version 9.5.1 that is why TLS 1.0/1.1 are still active. 

Can they upgrade directly to the latest version or do they need to upgrade in steps? 

Thanks again for the help

[DanCernese]

https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-a00118707en_us has the upgrade matrix..  Although I see now it doesn't go back that far.