Network Management

RabbitMQ Cipher Compatibility in FIPS and Non-FIPS Mode for SolarWinds Platform

When running the SolarWinds Platform, make sure that you have enabled a supported cipher in your Windows environment. Supported ciphers are different for FIPS mode and for non-FIPS deployments.

First published date

11/4/2019 11:00 PM

Last published date

2/6/2025 7:36 PM

Overview

The SolarWinds Platform uses RabbitMQ for communication. RabbitMQ enables a different set of ciphers when running the SolarWinds Platform in FIPS mode and non-FIPS mode. To make the communication work, at least one of the ciphers enabled by RabbitMQ must match a cipher enabled in Windows.

If you encounter the following error message in the RabbitMQ log, review ciphers supported for the appropriate mode (FIPS or non-FIPS), and then review ciphers enabled in your Windows. 
TLS server: In state hello at tls_handshake.erl:201 generated SERVER ALERT: Fatal - Handshake Failure - malformed_handshake_data
Another error that you can find is: 
ERROR SolarWinds.MessageBus.RabbitMQ.EasyNetQLogger - Failed to connect to broker HOSTNAME, port 5671, vhost / -> RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable ---> System.AggregateException: One or more errors occurred. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The client and server cannot communicate, because they do not possess a common algorithm    --- End of inner exception stack trace ---    at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)

And if Ciphers for RabbitMQ are missing, an error will be reported right away on the recommendations log regarding RabbitMQ ERROR.


My Orion Deployment shows the error "Verify MessageBus connection" for RabbtMQ.
image.png

RabbitMQ logs is flooded with errors showing "no suitable ciphers".
image.png

Product section

Orion Platform

Cause

  • Supported cipher in Windows environment Is Disable.
  • FIPS is disable in the environment.

Resolution

FIPS Mode On

When running the SolarWinds Platform in the FIPS mode, make sure that at least one of the following ciphers for your SolarWinds Platform version is enabled in Windows.
Warning: Not all supported ciphers might work for you; you need to enable a cipher that will work for your specific environment.

SolarWinds Platform 2024.1 and later

{ecdhe_ecdsa, aes_256_gcm, aead, sha384}
{ecdhe_ecdsa, aes_128_gcm, aead, sha256}
{dhe_dss, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_128_gcm, aead, sha256}

SolarWinds Platform 2022.4 - 2023.4

{dhe_dss,aes_256_gcm, aead, sha384}
{dhe_rsa,aes_128_gcm, aead, sha256}

SolarWinds Platform 2022.3 and earlier, Orion Platform 2020.2.6 and earlier

{dhe_rsa, aes_256_gcm, aead, sha384}
{dhe_dss, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_256_cbc, sha256}
{dhe_dss, aes_256_cbc, sha256}
{dhe_rsa, aes_128_gcm, aead, sha256}
{dhe_dss, aes_128_gcm, aead, sha256}
{dhe_rsa, aes_128_cbc, sha256}
{dhe_dss, aes_128_cbc, sha256}
 

FIPS Mode Off

When you are not running the SolarWinds Platform in the FIPS mode, ensure you have at least one of the following ciphers enabled in Windows.
Warning: Not all supported ciphers might work for you; you need to enable a cipher that will work for your specific environment.

SolarWinds Platform 2024.1 and later

{ecdhe_ecdsa, aes_256_gcm, aead, sha384}
{ecdhe_ecdsa, aes_128_gcm, aead, sha256}
{ecdhe_rsa, aes_256_gcm, aead, sha384}
{ecdhe_rsa, aes_128_gcm, aead, sha256}
{dhe_dss, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_128_gcm, aead, sha256}
{ecdh_ecdsa, aes_256_gcm, aead, sha384}
{ecdh_rsa, aes_256_gcm, aead, sha384}
{ecdh_ecdsa, aes_128_gcm, aead, sha256}
{ecdh_rsa, aes_128_gcm, aead, sha256}
{dhe_dss, aes_128_gcm, aead, sha256}


SolarWinds Platform 2022.4 - 2023.4

{ecdhe_rsa, aes_256_gcm, aead, sha384}
{ecdhe_ecdsa, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_256_gcm, aead, sha384}

SolarWinds Platform 2022.3 and Earlier, Orion Platform 2020.2.6 and earlier

{ecdhe_rsa, aes_256_gcm, aead, sha384}
{ecdhe_ecdsa, aes_256_gcm, aead, sha384}
{ecdhe_rsa, aes_256_cbc, sha384, sha384}
{ecdhe_ecdsa, aes_256_cbc, sha384, sha384}
{ecdhe_rsa, aes_128_gcm, aead, sha256}
{ecdhe_ecdsa, aes_128_gcm, aead, sha256}
{ecdhe_rsa, aes_128_cbc, sha256, sha256}
{ecdhe_ecdsa, aes_128_cbc, sha256, sha256}
{ecdh_rsa, aes_256_gcm, aead, sha384}
{ecdh_ecdsa, aes_256_gcm, aead, sha384}
{ecdh_rsa, aes_256_cbc, sha384, sha384}
{ecdh_ecdsa, aes_256_cbc, sha384, sha384}
{ecdh_rsa, aes_128_gcm, aead, sha256}
{ecdh_ecdsa, aes_128_gcm, aead, sha256}
{ecdh_rsa, aes_128_cbc, sha256, sha256}
{ecdh_ecdsa, aes_128_cbc, sha256, sha256}
{dhe_rsa, aes_256_gcm, aead, sha384}
{dhe_dss, aes_256_gcm, aead, sha384}
{dhe_rsa, aes_256_cbc, sha256}
{dhe_dss, aes_256_cbc, sha256}
{dhe_rsa, aes_128_gcm, aead, sha256}
{dhe_dss, aes_128_gcm, aead, sha256}
{dhe_rsa, aes_128_cbc, sha256}
{dhe_dss, aes_128_cbc, sha256}

Add the cipher to the rabbitmq.config file found in C:\ProgramData\SolarWinds\Orion\RabbitMQ. The cipher should also match the Windows cipher. You can use IIS Crypto to do a cross-check between the Windows cipher and the supported RabbitMQ cipher if FIPS is on or off.

NOTE: Every time you run the Configuration Wizard, the \ProgramData\SolarWinds\Orion\RabbitMQ\rabbitmq.config file is overwritten. If you run the Configuration Wizard on the main polling engine, you need to redo any changes to this file.


Additional suggestions on hardening of SolarWinds Platform environment can be found here: