-
Titel
Website monitoring is failing due to the web server for the monitored site mismatch between SSL protocol version used by the client and the server. -
Beschreibung
Website monitoring is failing due to the web server for the monitored site only accepting TLS 1.2 requests. Why does Web Monitor only support TLS 1.0 by default out of the box?
Web Monitor certainly ought to support newer versions of TLS out of the box because at the end of June 2018, TLS 1.0 and TLS 1.1 will be considered obsolete and be a PCI violation.
Foglight Web Monitor triggers the alarm:"Cannot access the URL https://> due to SSLException: Received fatal alert: protocol_version. There is a mismatch between SSL protocol version used by the client and the server. Your client should use a server supported protocol version. Please change "Force TLSv1" to "False" in the agent properties and try again.
-
Ursache
With the 'Force TLSv1.0' set to "true", if a web server only has TLS 1.2 enabled (not TLS 1.0), then the connection will not succeed. The web monitor client can only use version 1.0. And the web server can only use version 1.2. There's no version of TLS they have in common that they can negotiate to use.A defect is logged to change the TLSv1 default option from true to false: IC-4117 -
Lösung
WORKAROUND
- In the FMS web console, go to 'Administration' | 'Agents' | 'Agent Status'
- Check the checkbox of the web monitor agent attempting to reach this website in question | click 'Edit Properties' button
- Click on the 'Modify the private properties for this agent' link.
- Select the 'Force TLSv1' radio button to be "false".
- Restart agent
If TLSv1 is disabled the WebMonitor agent will use TLS version 1.2
STATUS:
IC-4117 is fixed in 5.9.3 release of WebMonitor agent.
-
Fehler-ID
IC-4117