How to set Client SSL Protocols and Ciphers in OpenEdge

How to set SSL Protocols and Ciphers in OpenEdge 

How to set the correct SSL Protocols and Ciphers in OpenEdge

How to determine which SSL Protocols and Ciphers a remote server is using

How to configure client ciphers so that there is no a cipher mismatch between OpenEdge's default cipher and the ciphers supported by the server ?

Starting OE 12.2 the client now supports all ciphers supported by OpenSSL:
ABL client default cipher suites for SSL
For other versions, follow the instructions outlined below.

Set the Protocol and Ciphers that both OpenEdge and the Server or Service supports.

1) Determine which SSL Protocols and Ciphers are in use:

To get general security information about a site, use SSLLabs' SSL Server Test:
https://www.ssllabs.com/ssltest/

An example is provided in Article: Identifying what SSL/TLS ciphers a server supports.

To get the current session protocol and ciphers information, use one of the following methods:

Option #1: Enable SSL debugging

1. Enable SSL debugging [ SSLSYS_DEBUG_LOGGING ] using the steps outlined in Article: How to enable SSL debugging in OpenEdge?.
2. Execute the code in question and examine the cert.client.log and cert.server.log

Option #2: Test the connection with s_client -connect

1. proenv> sslc s_client -connect <domain name>:<port>  -showcerts -CApath %DLC%\certs -msg
2. Analyse the sslc output

Entries for the Protocol and Cipher are written under SSL-Session in either the cert.client.log, cert.server.log, or the sslc output. Example:
            

2) Configure the session to use the required SSL protocol and/or cipher.

ABL clients:

Option #1 -  Use -sslprotocols , -sslciphers in the CONNECT() method:

-URL https://aia.webclientHost.com:8443/aia/AiaName1?AppService=MyApplicationService -sslprotocols TLSv1.2 -sslciphers AES128-SHA

-WSDL myWsdl.wsdl -sslprotocols TLSv1.2 -sslciphers ECDHE-RSA-AES256-GCM-SHA384

Option #2 - Set the Environment variables on the client machine:

• PSC_SSLCLIENT_PROTOCOLS
• PSC_SSLCLIENT_CIPHERS

Windows:
     set PSC_SSLCLIENT_PROTOCOLS=TLSv1.2 
     set PSC_SSLCLIENT_CIPHERS=DHE-RSA-AES256-SHA 

UNIX:
     export PSC_SSLCLIENT_PROTOCOLS=TLSv1.3
     export PSC_SSLCLIENT_CIPHERS=DHE-RSA-AES256-SHA

HTTP client: 
Use the OpenEdge.Net.HTTP.Lib.ClientLibraryBuilder, SetSslProtocols() and SetSslCiphers() Methods outlined in Article: How to set SSL Protocols and Ciphers to use in the HTTP client?  
    
PAS OE instance: 
Configure {CATALINA_BASE}\conf\catalina.properties outlined in Article: How to configure the TLS versions which are supported by a PASOE instance  

• psc.as.https.protocol
• psc.as.https.ciphers

Unified Brokers:
Configure Environment Variables and ssl algorithms for negotiation in: <DLC>\properties\ubroker.properties outlined in Article: How to specify UBroker cipher suite and ssl protocols  

• PSC_SSLSERVER_CIPHERS,
• PSC_SSLSERVER_PROTOCOLS
• sslAlgorithms 

ODBC, JDBC Client:  
Configure Environment Variables and properties, outlined in Article: OpenEdge SQL SSL communication – release 11.6.1  

• PSC_SQL_SSLSERVER_CIPHERS
• PSC_SSLSERVER_CIPHERS
• EnableCipherSuites
• CryptoProtocolVersion 

When communicating with an SNI enabled site, prevent error code 17424 from failing the negotiation, outlined in Article: SSL routines error with HTTP Client and SNI-enabled site   

 

References to Other Documentation:

OpenEdge Getting Started: Core Business Services: Security and Auditing, Security in OpenEdge, SSL Security - Changing the cryptographic protocol, ciphers, and certificates:

• Supported protocols, ciphers, and certificates for Progress OpenEdge clients and servers

• Changing the default protocols and ciphers

Progress Articles:
  
ADH* series are not supported ciphers
Identifying what SSL/TLS ciphers a server supports.
How to set TLS/SSL protocols and ciphers to use in the HTTP client?
Identifying what SSL/TLS ciphers a server supports.
Ciphers supported by OpenEdge
ABL client default cipher suites for SSL
Client stops reading through the available ciphers list 50% of the time when an unsupported cipher is encountered in the list
OEAUTH and stsclientutil can only use one protocol