Security Compliance

Cipher Suites accepted by Access Rights Manager

ARM 2020.2.3 or higher utilizes encryption (TLS) for communication between its components. For this, certain cipher suites must be available on the systems involved.

First published date

2/18/2021 4:10 PM

Last published date

9/15/2023 5:08 AM

Overview

ARM requires that certain cipher suites are available on the Windows servers (ARM server, collector servers) involved. If these are not available, they can be enabled using on-board or 3rd party tools.

Product section

Access Rights Manager

Cause

ARM will not install or will stop working if the required Cipher Suites are not available. Required Cipher Suites are

  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS_RSA_WITH_AES_256_GCM_SHA384

It is sufficient if only one of the above cipher suites is available.

Resolution

Enable one of the required Cipher Suites by using PowerShell or the 3rd party tool IIS Crypto from Nartac Software.

Use PowerShell

You can find a detailed description on how to Enable-TlsCipherSuite in the article from Microsoft.

Example of the PowerShell command
PS C:\>Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"


Use IIS Crypto

Download the tool IIS Crypto from Nartac Software and run it with administrator privileges (no installation required). 
Select the Cipher Suites tab and enable at least one of the required cipher suites.

The ARM server must be restarted for the settings to take effect.