8

We are running SDL Web 8.5 CID micro-service on a linux environment using the start.sh script. This service reaches out to a https website to fetch the images before then modifying them for final use. Our https site is configured to use TLSv1.2.

When the micro-service attempts to fetch an image from our https site we receive the following error:

2019-08-21 14:57:55,182 WARN  ContentTypeAcquirer - Warning, could not get content type from input stream for resource 'https://www.oursite.com/en/assets/ourimage.jpg'
javax.net.ssl.SSLException: Received fatal alert: protocol_version
        at com.ibm.jsse2.k.a(k.java:24)
        at com.ibm.jsse2.k.a(k.java:13)
        at com.ibm.jsse2.at.b(at.java:527)

We set the javax.net debugging to "all" and found the following in the logs:

*** ClientHello, TLSv1
[...]
http-nio2-8089-exec-5, WRITE: TLSv1 Handshake
[...]
http-nio2-8089-exec-5, READ: TLSv1.2 Alert, length = 2
http-nio2-8089-exec-5, RECV TLSv1.2 ALERT:  fatal, protocol_version

This seems to indicate that our CID micro-service is using TLSv1 while our site is using TLSv1.2.

We tried modifying our JVM arguments but it does not seem to have any impact:

-Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2

We also tried the following (to be thorough), but again, it has no impact:

-Djdk.tls.client.protocols=TLSv1,TLSv1.1,TLSv1.2 -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

Is there any way that we can configure the CID to use TLSv1.2 for these requests?

5

It looks like you are using an IBM JVM (at com.ibm.jsse2.k.a(k.java:24)). This JVM has some specific setting that allows you to enable or disable use of TLS V1.2.

This is explained here https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/matchsslcontext_tls.html#matchsslcontext_tls

Basically, you need to add this to the java options -Dcom.ibm.jsse2.overrideDefaultTLS=true in the start.sh script.

  • That indeed fixed the issue, thanks a bunch – Jonathan Primmer Aug 22 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.