Applications Systems

Could not establish secure channel for SSL/TLS at System.ServiceModel.Channels.HttpChannelFactory in VMAN

If you see this error in the Job Engine log and are unable to poll any VMAN data after configuring 2048 bit-long Diffie-Hellman ephemeral (DHE) key shares for TLS servers, follow the steps in this article to be able to poll virtualization data again.

First published date

5/14/2019 3:51 PM

Last published date

5/31/2022 2:34 PM

Overview

By default, VMAN Java polling does not work when a user has configured the Diffie-Hellman key exchange algorithm to use 2048 bit keys, or if Diffie-Hellman is not enabled at all. In this case, the user will see an error similar to the following example in the Job Engine log:

2019-04-23 13:24:27,473 [STP SmartThreadPool Thread #70] ERROR SolarWinds.JobEngine.Engine.WorkerDispatcher -
(null) WorkerProcess failed to start
System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'localhost:49152'. --->
System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
at System.Net.HttpWebRequest.GetResponse()
at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
--- End of inner exception stack trace ---

 

Product section

Virtualization Manager

Cause

Diffie-Hellman on the Java side in VMAN 8.4 and earlier uses only 1024 bit keys by default. Support for 2048 bit and higher has to be explicitly enabled.

Resolution

Solution#1: Ensure that Diffie-Hellman is enabled and that it uses a 1024-bit key.

Warning: SolarWinds strongly recommends that you back up your registry before editing your system registry. You should only edit the registry if you are experienced and confident in doing so. Using a registry editor incorrectly can cause serious issues with your operating system, which could require you to reinstall your operating system to correct them. SolarWinds cannot guarantee resolutions to any damage resulting from making registry edits. For assistance, contact Support.

DHE should be enabled by default, and by default it uses a 1024-bit key, but it can be disabled, or the bitlength can be changed.
  1. Make sure that Diffie-Hellman is not explicitly disabled in the registry:
 
Enabled must be set to 1, or there must be no Enabled key in the registry at all.
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

Enabled    1
 
  1. Make sure that Diffie-Hellman is not forced to use longer than 1024 bit key:
 
ServerMinKeyBitLength and ClientMinKeyBitLength must be set to 1024, or there must be no ServerMinKeyBitLength and ClientMinKeyBitLength keys present in the registry at all.
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

ServerMinKeyBitLength   1024
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

ClientMinKeyBitLength   1024
 
  1. Restart Orion server machine to apply registry changes.
 

Solution#2: Configure VMAN to accept longer than 1024 bit Diffie-Hellman keys

Warning: SolarWinds strongly recommends that you back up your registry before editing your system registry. You should only edit the registry if you are experienced and confident in doing so. Using a registry editor incorrectly can cause serious issues with your operating system, which could require you to reinstall your operating system to correct them. SolarWinds cannot guarantee resolutions to any damage resulting from making registry edits. For assistance, contact Support.
 
If 2048-bit long keys are needed, you can enable support for longer keys in VMAN.
 
Check DHE registry settings for 2048 bit:
Before enabling 2048-bit support in VMAN, confirm that 2048-bit DHE is enabled in the registry:
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

Enabled    1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

ServerMinKeyBitLength   2048

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

ClientMinKeyBitLength   2048
 
(2048 is dword:00000800)
 
To enable 2048 bit keys in VMAN:
1.  Go to Centralized Settings:
http://<OrionServerIPAddressOrHostname>/Orion/Admin/AdvancedConfiguration/Global.aspx
2.Search for "CustomWorkerCommandParams" (without quotation marks)
3.  Append the string "-Djdk.tls.ephemeralDHKeySize=2048" to the current value to force DH to use 2048 on the java server side. The final value should look like this:
 
-Xmx1536M -Djdk.tls.ephemeralDHKeySize=2048

4.Clear the JobEngine SDF database:
 
a)   Stop the JobEngine v2 service via Orion Service Manager
b)  Go to C:\ProgramData\SolarWinds\JobEngine.v2\Data\
c)  Make a backup of JobEngine35.sdf named JobEngine35-backup.sdf.
d)  Replace JobEngine35.sdf with a blank file. Make a new text file named JobEngine35.sdf and overwrite the original JobEngine35.sdf.
e)  Make sure that the newly created file is not read-only.
 
5.Check in Windows Task Manager: If there are still any OpenJDK processes running, kill those processes.
6.Start the JobEngine v2 service in Orion Service Manager.