How to Verify TLS 1.2 Connectivity on RSA Authentication Manager 8.x Using OpenSSL

a day ago

Originally Published: 2016-07-15

Article Number

000067178

Applies To

RSA Product Set : SecurID
RSA Product/Service Type : RSA Authentication Manager
RSA Version/Condition: 8.1 Service Pack 1 or 8.2
Platform : SUSE Enterprise Linux
O/S Version : 11
Product Description : SecurID Appliance

Issue

Administrators may need to verify that RSA Authentication Manager 8.x is actively negotiating TLS 1.2 connections as part of a security audit, compliance review, or when RSA Support requests confirmation of the TLS configuration.

This article uses the OpenSSL s_client command to test TLS connectivity against the Authentication Manager Security Console and Operations Console ports. The default OpenSSL version on the SecurID Appliance does not support TLS 1.2 testing — a newer binary must be used.

Prerequisites:

SSH access to the SecurID Appliance (enabled via Operations Console > Administration > Operating System Access)
rsaadmin credentials for the SecurID Appliance
OpenSSL 1.0.2d binary (attached to this article) or a machine with OpenSSL 1.0.1 or later installed
Operations Console administrator username and password

Tasks

This article covers two methods for verifying TLS 1.2 on Authentication Manager 8.x. Use the table below to jump to the method that applies to your environment:

Task	Method	Applies To	Key Detail
Task 1	Test TLS 1.2 connectivity using `openssl s_client`	AM 8.1 SP1 or 8.2	Requires OpenSSL 1.0.2d binary
Task 2	Verify TLS 1.2 configuration using `configure_tls12_mode.sh`	AM 8.1 SP1 P15 (already patched)	Confirms no further changes are needed

Resolution

Task 1: Test TLS 1.2 Connectivity Using OpenSSL s_client

ℹ️ NOTE — OpenSSL 1.0.2d (9 Jul 2015) is required to test TLS 1.2 connectivity and is attached as a binary to this article.

RSA Authentication Manager 8.1 SP1 Patch 15 with Third Party Patch 2.0 updates OpenSSL on the appliance to version 0.9.8j-fips 07 Jan 2008 — this version cannot test TLSv1.2 connectivity.
RSA Authentication Manager 8.2 ships with OpenSSL 0.9.8j-fips 07 Jan 2008 by default, which also cannot test TLSv1.2.
The OpenSSL utility resides in /usr/bin on the SecurID Appliance.

Step 1: Log on to the SecurID Appliance with the rsaadmin account via the local console or an SSH client.

ℹ️ NOTE — SSH can be enabled via Operations Console > Administration > Operating System Access > Enable SSH.

Step 2: Back up the existing OpenSSL binary:

sudo mv /usr/bin/openssl /usr/bin/openssl.ORIG

⚠️ CAUTION — This renames the existing OpenSSL binary. Keep the .ORIG file — it can be restored if needed.

Step 3: Extract the attached OpenSSL 1.0.2d binary and copy it to /usr/bin/. Ensure permissions are set to 755 (-rwxr-xr-x), with owner and group both set to root.

Step 4: Verify the OpenSSL version:

openssl version

Expected output:

rsaadmin@<appliance-hostname>:~> openssl version
OpenSSL 1.0.2d 9 Jul 2015

ℹ️ NOTE — Supported protocols by version:

AM 8.1 SP1 Patch 15 can negotiate SSLv3, TLSv1, TLSv1.1, and TLSv1.2 on the Security Console 7004/tcp port and Operations Console 7072/tcp port.
AM 8.2 can negotiate TLSv1, TLSv1.1, and TLSv1.2 on the Security Console 7004/tcp port and Operations Console 7072/tcp port.

Step 5: Run openssl s_client using the following syntax:

openssl s_client -connect <fully-qualified-hostname>:<port-number> <parameter>

Parameter	Description
`<fully-qualified-hostname>`	Fully qualified hostname of the Authentication Manager instance (e.g., `am-primary.example.com`)
`<port-number>`	TCP port number (e.g., `7004`)
`<parameter>`	`-ssl3` for SSLv3 \| `-tls1` for TLSv1 \| `-tls1_1` for TLSv1.1 \| `-tls1_2` for TLSv1.2

Step 6: Test TLS 1.2 connectivity. Example command:

openssl s_client -connect <am-primary.example.com>:7004 -tls1_2

Expected output (certificate block replaced with placeholder — values will vary per environment):

CONNECTED(00000003)
depth=1 CN = RSA root CA for <am-primary.example.com>, serialNumber = <serialNumber>
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:/CN=<am-replica.example.com>/serialNumber=<serialNumber>
   i:/CN=RSA root CA for <am-primary.example.com>/serialNumber=<serialNumber>
 1 s:/CN=RSA root CA for <am-primary.example.com>/serialNumber=<serialNumber>
   i:/CN=RSA root CA for <am-primary.example.com>/serialNumber=<serialNumber>
---
Server certificate
-----BEGIN CERTIFICATE-----
[Certificate data omitted]
-----END CERTIFICATE-----
subject=/CN=<am-replica.example.com>/serialNumber=<serialNumber>
issuer=/CN=RSA root CA for <am-primary.example.com>/serialNumber=<serialNumber>
---
No client certificate CA names sent
Peer signing digest: SHA1
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2319 bytes and written 443 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 57888979ED31AF1CB3858B681617413D9F4A441A5253412053534C4A20202020
    Session-ID-ctx:
    Master-Key: C465B930304527819EF3F8CC33F59A1FF22357E1023FAA8A62EA6F150E9CC779
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1468565882
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---

Step 7 — Verify: Confirm the following key lines appear in the output:

Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384

✅ If Protocol : TLSv1.2 is present, Authentication Manager is successfully negotiating TLS 1.2.

ℹ️ NOTE — To confirm SSLv3 is rejected on an AM 8.2 instance, run:

openssl s_client -connect <am-primary.example.com>:7004 -ssl3

Expected output confirming SSLv3 is disabled:

CONNECTED(00000003)
26144:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:283:

Task 2: Verify TLS 1.2 Configuration Using configure_tls12_mode.sh

Use this task on an Authentication Manager 8.1 SP1 P15 instance where TLS 1.2 has already been enabled, to confirm no further changes are needed to /opt/rsa/am/server/config/config.xml, AdminServerWrapper.conf, ConsoleServerWrapper.conf, RadiusOCServerWrapper.conf, /opt/rsa/am/server/wrapper/BiztierServerWrapper.conf, and /opt/rsa/am/rsapgdata/postgresql.conf.

Step 1: Log on to the SecurID Appliance as rsaadmin via SSH.

Step 2: Navigate to the Authentication Manager utils directory:

cd /opt/rsa/am/utils

Step 3: Run the TLS 1.2 configuration script with the --enable flag:

./configure_tls12_mode.sh --enable

Expected output:

rsaadmin@<appliance-hostname>:/opt/rsa/am/utils> ./configure_tls12_mode.sh --enable
Jul 15 2016 17:06:17 AEST :  ********* Enable TLSv1.2 configurations in RSA Authentication Manager Server - Begin *********
Jul 15 2016 17:06:17 AEST :  Stopping RSA Authentication Manager Services
Stopping RSA RADIUS Server: **
RSA RADIUS Server                                          [SHUTDOWN]
Stopping RSA Runtime Server: ***
RSA Runtime Server                                         [SHUTDOWN]
Stopping RSA Console Server: *
RSA Console Server                                         [SHUTDOWN]
Stopping RSA Database Server: **
RSA Database Server                                        [SHUTDOWN]
Stopping RSA RADIUS Server Operations Console: **
RSA RADIUS Server Operations Console                       [SHUTDOWN]
Stopping RSA Administration Server with Operations Console: *
RSA Administration Server with Operations Console          [SHUTDOWN]

Jul 15 2016 17:06:44 AEST :  *** Backing up configuration files to make changes
Jul 15 2016 17:06:44 AEST :  *** Applying TLS configurations to /opt/rsa/am/server/config/config.xml
Jul 15 2016 17:06:44 AEST :  TLS configurations exist in /opt/rsa/am/server/config/config.xml, no changes required
Jul 15 2016 17:06:44 AEST :  File permissions remain same, permissions of /opt/rsa/am/server/config/config.xml before and after changes are 644 and 644
Jul 15 2016 17:06:44 AEST :  *** Applying TLS configurations to Wrapper files in /opt/rsa/am/server/wrapper
Jul 15 2016 17:06:44 AEST :  TLS configurations -Dcom.rsa.requiredProtocols exist in AdminServerWrapper.conf, no changes required
Jul 15 2016 17:06:44 AEST :  TLS configurations -Dcom.rsa.requiredProtocols exist in ConsoleServerWrapper.conf, no changes required
Jul 15 2016 17:06:44 AEST :  TLS configurations -Dcom.rsa.requiredProtocols exist in RadiusOCServerWrapper.conf, no changes required
Jul 15 2016 17:06:44 AEST :  TLS configurations -Dcom.rsa.requiredProtocols exist in /opt/rsa/am/server/wrapper/BiztierServerWrapper.conf, no changes required
Jul 15 2016 17:06:44 AEST :  TLS configurations -Dcom.rsa.oa.requiredProtocols exist in /opt/rsa/am/server/wrapper/BiztierServerWrapper.conf, no changes required
Jul 15 2016 17:06:44 AEST :  TLS configurations -Dcom.rsa.oa.requiredCiphers exist in /opt/rsa/am/server/wrapper/BiztierServerWrapper.conf, no changes required
Jul 15 2016 17:06:44 AEST :  File permissions remain same, permissions of /opt/rsa/am/server/wrapper/BiztierServerWrapper.conf before and after changes are 400 and 400
Jul 15 2016 17:06:44 AEST :  *** Updating /opt/rsa/am/rsapgdata/postgresql.conf
Jul 15 2016 17:06:44 AEST :  postgres.conf contains value \!DH:\!ECDSA:TLSv1.2+HIGH+RSA:TLSv1.2+HIGH:@STRENGTH for ssl_ciphers, no changes required
Jul 15 2016 17:06:44 AEST :  Starting RSA Authentication Manager Services
Starting RSA Administration Server with Operations Console:
RSA Administration Server with Operations Console          [RUNNING]
RSA Database Server                                        [RUNNING]
RSA RADIUS Server Operations Console                       [RUNNING]
RSA Runtime Server                                         [RUNNING]
RSA RADIUS Server                                          [SHUTDOWN]
RSA Console Server                                         [SHUTDOWN]

Jul 15 2016 17:09:00 AEST :  ********* TLSv1.2 enabled in RSA Authentication Manager Server - End *********

Step 4 — Verify: Confirm the output contains "no changes required" for all configuration files and ends with:

********* TLSv1.2 enabled in RSA Authentication Manager Server - End *********

✅ If all lines report "no changes required" and the script completes without errors, TLS 1.2 is already fully configured on this instance.

Notes

RFC Reference: TLS 1.2 was defined in RFC 5246 in August 2008.

Don't see what you're looking for?

Salesforce MFA Enforcement – Action Required

Task 1: Test TLS 1.2 Connectivity Using OpenSSL s_client

Task 2: Verify TLS 1.2 Configuration Using configure_tls12_mode.sh

Related Articles

Trending Articles