AWS AFX Connector "SSLHandshakeException: Could not generate secret" error in RSA Governance & Lifecycle
2 years ago
Article Number
000072163
Applies To
  • Securid Governance & Lifecycle 7.5.2 
  • RSA Governance & Lifecycle 8.0.0 
Issue
The AWS (Amazon Web Services) AFX Connector fails with the following error message in the esb.AFX-CONN-{AWS connector name}Connector.log file.
  
2024-02-30 16:15:12.064 [ERROR] com.aveksa.AFX.server.runtime.esb.amazonaws.esb.AmazonAWSComponent:361 - Unable to execute HTTP request: Could not generate secret
com.amazonaws.SdkClientException: Unable to execute HTTP request: Could not generate secret
...
Caused by: javax.net.ssl.SSLHandshakeException: Could not generate secret
at sun.security.ssl.ECDHKeyExchange$ECDHEKAKeyDerivation.t13DeriveKey(ECDHKeyExchange.java:479)

 
Cause
AFX is unable to complete a TLSv1.3 SSL connection. 
Resolution
This issue is resolved in the following versions by disabling TLSv1.3 in AFX Connectors.
  • RSA Governance & Lifecycle 8.0.0 P02
Workaround

In the following version 

  • Securid Governance & Lifecycle 7.5.2


Edit the /home/oracle/AFX/esb/conf/wrapper.conf

At line 31 in wrapper.conf insert the following line.

wrapper.java.additional.11=-Djdk.tls.client.protocols=TLSv1.2

Restart AFX for the changes to take effect.

This modification must be done if you patch 7.5.2 or redeploy a new AFX instance on 7.5.2

(Customers on 8.0.0 version should patch to the latest patch.)

Don't see what you're looking for?