Client run from command line cannot connect via SSL

The OpenEdge client fails to connect to an SSL server that uses a SHA256 certificate when the client is run from the command line.
The OpenEdge client fails to connect to an SSL server that uses a SHA2 certificate when the client is run from the command line.
The WSDL Analyzer (bprowsdldoc) fails to connect to an SSL-enabled Web Service that uses a SHA256 certificate.
The WSDL Analyzer (bprowsdldoc) fails to connect to an SSL-enabled Web Service that uses a SHA2 certificate.

The connection is successful when the ABL code is executed from within a Procedure Editor.

The OpenEdge client does not initialize the OpenSSL library with all required ciphers when the client session is started directly from the command line.

The problem does not occur in the Procedure Editor because the Procedure Editor code makes a connection to an internal temp-table at startup. The temp-table connection, which is internally the same as a database connection, causes all of the necessary initialization code to run. All required ciphers are then available to any ABL code that is run in the Procedure Editor for the rest of the session.

Upgrade to OpenEdge 10.2B0848.
For further details, please reference the whitepaper "Addressing POODLE vulnerability and SHA2 support in Progress OpenEdge 10.2B08".

Upgrade to OpenEdge 11.3.3.026.
For further details, please reference the whitepaper "Addressing POODLE vulnerability and SHA2 support in Progress OpenEdge 11.3.3​".

Upgrade to OpenEdge 11.4.0.028.
For further details, please reference the whitepaper  "Addressing the POODLE Vulnerability in Progress OpenEdge in 11.4.0.028HF".

Upgrade to OpenEdge 11.5.1.015 .
For further details, please reference the whitepaper  "Addressing POODLE vulnerability and SHA2 support in Progress OpenEdge 11.5.1".

Upgrade to OpenEdge 11.6 or later.
For further details, please reference "OpenEdge Getting Started: Core Business Services - Security and Auditing, Chapter 2, Security in OpenEdge > SSL Security" in the OpenEdge 11.6 documentation set.


 

For an ABL client
Define an arbitrary temp-table at the beginning of the ABL application code. The connection to this temp-table will force the session to properly initialize the OpenSSL library, as happens when the ABL code is run within the Procedure Editor. For example:
 
Alternatively, make a connection to any database at the beginning of the ABL application code.


For the WSDL Analyzer

1. Open the WSDL URL in a browser.
2. Save the WSDL document to a local file.
3. Run the WSDL Analyzer against the local copy of the WSDL document. For example:

References to Other Documentation:

Progress Article(s):

"How does the POODLE vulnerability affect OpenEdge ?"
 Does OpenEdge 10.x or 11.x support SHA-2 signed certificates?