Enable TLS in Orion Platform products

11/29/2018 12:11 AM

8/10/2022 8:15 AM

Products running on Orion Platform require TLS to be enabled on the server. When TLS is disabled, some of the following errors may occur:

• HTTPS monitoring can stop
• NCM does not work as expected
• IP Monitor Service can fail to start
• Server & Application Monitor may have errors
• SWIS cannot communicate with RabbitMQ (TLS 1.2)
• Orion Web Console fails to stop working (TLS 1.2)
• SNMP v3 may not work

Orion Platform

N/A

First, check TLS compatibility with Orion Platform products to verify which version(s) of TLS is required to be enabled on your server for the Orion Platform to operate.

Refer to this Microsoft article (© 2018 Microsoft., available at http://docs.microsoft.com/, obtained on November 28, 2018) for detailed information on which TLS protocol versions are supported and enabled by default on supported Microsoft Windows version. For example:

• on Windows Server 2008 or later, TLS 1.0 is enabled by default
• on Windows 8 and Windows Server 2012 or later, TLS 1.1 and TLS 1.2 are enabled by default.

Further steps will require modification to the Windows Registry. SolarWinds strongly recommends that you back up your registry before making any edits to your system registry. You should only edit the registry if you are experienced and confident in doing so. Using a registry editor incorrectly can cause serious issues with your operating system, which could require you to reinstall your operating system to correct them. SolarWinds cannot guarantee resolutions to any damage resulting from making registry edits.

1. Log in to the computer hosting SolarWinds Orion Server as an administrator.

2. Open the registry editor.

3. Back up your registry.

4. To enable TLS 1.0, find or create the following keys:

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server

5. To enable TLS 1.1, find or create the following keys:

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server

6. To enable TLS 1.2, find or create the following keys:

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server

7. In each key from previous steps, find or create the following REG_DWORD values:

   • DisabledByDefault with the value set to 0 decimal

   • Enabled with the value set to 0xFFFFFFFF 

   Note: To disable a TLS version, set Enabled to 0 and DisabledByDefault to 1 for keys specific to the TLS version.

8. Reboot the computer to apply changes after which TLS 1.0, TLS 1.1, and TLS 1.2 will be enabled.

Alternative Tool

1. Log in to the computer hosting SolarWinds Orion Server as an administrator.

2. Download and install IIS Crypto from Nartac. (© 2013 Nartack Software, available at https://www.nartac.com/, obtained on Feb 3, 2017.)

3. Open the tool.

4. Select Schannel and the other Registry entry as required.

5. Apply changes and restart the computer.

If you are allowed to run only one TLS version at the same time and experience issues with desktop tools, such as Trap Viewer or Syslog Viewer, see the article about Desktop tools like Trap Viewer, Syslog Viewer, Account Limitation Builder do not work if TLS 1.0 is disabled

Alternate steps from Microsoft

Use the Windows Registry Editor to navigate to the following keys:

HKEY_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNELS\Protocols\TLS1.2\Server Set Enabled Value (DWORD) to 1.
HKEY_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNELS\Protocols\TLS1.2\Client Set Enabled Value (DWORD) to 1.

In case registry keys (or values) do not exist then create them. Then restart the computer.

Following steps from Microsoft (© 2024 Microsoft, available at https://www.microsoft.com, obtained on March 29, 2024) that are also noted in Deployment Health Problem for TLS1.2 notification.