iMC E0705P10 with NTA E0509 - TLS MS-SQL Connection: NTA fails with "SSL Security Error"

[Jannie Hanekom]

Hi

Some time ago we disabled SSLv3 and TLS1.0 on both our iMC and MS SQL Servers.  iMC E0705 continued functioning normally, but we've since discovered that NTA no longer imports data correctly.

The following is logged repeatedly in the "processor" log files on the iMC server (C:\Program Files\iMC\unba\log):

2021-04-15 11:48:01 [WARNING (0)] Ado error code=0, error message=[DBNETLIB][ConnectionOpen (SECDoClientHandshake()).]SSL Security error..
2021-04-15 11:48:01 [ERROR (0)] Connect database fail, ip=BMZASRVSQL002\IMCDB, inst=unba_slave, user=unba_slave.
2021-04-15 11:48:01 [ERROR (0)] Connection is not openning.

I believe that this issue is caused by disabling TLS 1.0.  iMC formally supports TLS 1.1/1.2, how do I find out if the NTA module is compatible and - if so - how to go about enabling it?

[Milenkova · Accepted solution]

Hello Janie,

This is a known issue  and should be solved in the new NTA version .

However there is a workaround:

1. NTA no longer shows any data when running Windows Server 2016 and following the steps to enable TLS 1.1/1.2

Modify the configuration file of NTA to support TLS 1.2.

1. Stop processor.exe and receiver.exe processes in the DMA.
2. Open and modify the sysprocessor.xml file in the iMC directory, the file path: iMC\unba\conf\ sysprocessor.xml
3. <!-- SQL Server数据库是否使用TLS -->

   
   <DBAdoUseTls>false</DBAdoUseTls>

False -> true

Start processor.exe and receiver.exe processes in the DMA, and then check TLS function.

I have asked PDT to provide a way to activate/deactivate that TLS 1.2 feature in GUI rather than messing up with the sysprocessor.xml

Kind regards,

[Jannie Hanekom]

Implemented the workaround, works a charm!  Thanks VERY much.

I still can't see any data in the GUI, but it looks like that's just because there's a very large backlog that needs to be processed.

In reviewing the contents of C:\Program Files\iMC\Data\recieverData and processorData (as well as looking at network traffic to the database server), I can see that the number of files stored there is gradually decreasing.  The TLS change was made a few months ago on our side, so there's quite a large backlog!