Security Compliance

TLS protocol and cipher changes in ARM 2025.4.0 and later

This article explains the TLS protocol and cipher suite changes introduced in Access Rights Manager (ARM) 2025.4.0 and later, and which cipher suites must be supported on the ARM server, collectors, and ARM clients for secure connections to succeed.

First published date

3/5/2026 12:32 PM

Last published date

4/1/2026 2:49 PM

Overview

From ARM 2025.4.0 onward, the ARM server only supports TLS 1.2 and TLS 1.3 for its secure channels, and restricts cipher suites to a hardened set. TLS 1.1 is no longer accepted, and TLS_RSA_WITH_AES_256_GCM_SHA384 (previously required in older ARM versions) has been removed to align with stronger security baselines.

Product section

Access Rights Manager

Cause

Strengthening the security framework and ciphers of the internal communication channels used in ARM.

Resolution

* These cipher suites are supported only on Windows Server 2016 and later. Environments running Windows Server 2012 or earlier do not support these cipher suites and should be upgraded to a supported version of Windows Server.

For information about supported operating system versions, see ARM Server requirements

 

 

Resolution 1 – Verify ARM version and components

  1. Confirm that the ARM server is running ARM 2025.4.0 or later (for example, via the ARM Configuration application or installed programs list).
  2. Ensure all collectors and ARM clients are updated to a version compatible with the ARM server (ideally the same major/minor version).

Resolution 2 – Ensure OS and crypto policies support the required ciphers

  1. On each relevant machine (ARM server, collectors, rich clients, and any intermediary systems terminating TLS for ARM), verify that:
    • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    • TLS_AES_256_GCM_SHA384
    • TLS_AES_128_GCM_SHA256
    • TLS 1.2 and/or TLS 1.3 are enabled, and
    • At least one of the following cipher suites is enabled and allowed:
  2. If the OS or security baseline tool (for example, group policy, OpenSSL cipher policy, or a hardening script) has disabled these ciphers, re-enable at least one of them or adjust the policy to include them.
  3. If the operating system is too old to support these ciphers (or TLS 1.2/1.3 in a compliant way), upgrade the OS to a supported and modern version per the ARM system requirements.
  4. After adjusting cipher or protocol settings, restart the ARM services on the server and affected collectors/clients.
  5. Confirm that:
    • Collectors show Connected/Online in the ARM Configuration application.
    • ARM clients (rich client or web components) can connect without TLS handshake errors.

If, after confirming that the OS supports at least one of the listed cipher suites and that TLS 1.2/1.3 are enabled, the connection still fails, gather ARM diagnostics and collector logs and contact SolarWinds Support for further analysis.