-
Title
TLS 1.0 Security Vulnerability -
Description
TLS 1.0 contains many security vulnerabilities and is being removed from use by many software companies. Quest AppAssure is one such software. On January 29, 2018, the Quest Rapid Recovery/AppAssure license portal will stop supporting TLS 1.0 connections. This change will affect the ability of any AppAssure 5.4.3 and older core servers from validating their license. When the license is unable to be validated, backups will no longer be able to run, but data restores will be allowed.
TLS 1.1 will continue to be supported until deemed insecure by major security institutions.
TLS 1.2 is supported by default
Example stack trace error:
Replay.Core.Contracts.Licensing.PhoneHomeFailedException: Communication with the license portal failed due to an error. Please contact support. ---> System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://services.licenseportal.com/PhoneHome/HeartBeat. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote hostat System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags)at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size) -
Cause
Quest is disabling TLS 1.0 support on the Rapid Recovery license portal
-
Resolution
In order for AppAssure 5.x Cores to be able to continue taking backups, please review the following sections from top to bottom:
Verify your Core is on a supported Operating System (OS) for TLS 1.1 & 1.2:
- Minimum required operating systems for AppAssure 5.4.3 include Windows Server 2008 SP2 & Windows 7 SP1 through Windows Server 2012 R2 & Windows 8.1.
- This is due to .NET 4.5.2 being required by patch P-1812. Patch P-1812 enables the Core to use TLS 1.1 & 1.2.
- If your Core OS does not meet the minimum requirement and you cannot upgrade to one that does, go the Request a No-Phone-Phone (NPH) Key section at the bottom of the Resolution.
NOTE: If you are using Microsoft Storage Server 2008 R2 please apply the following Microsoft update to enable TLS 1.1 and 1.2.
If you have Active Support:
- Upgrade to the most recent version of Rapid Recovery.
- Optional, but recommended, install the QDPP plug-in.
- If you cannot upgrade, continue to the next section.
If you do not have Active Support or cannot upgrade:
Cores running builds prior to AppAssure 5.4.3:
Only AppAssure 5.4.3 can utilize TLS 1.1 & 1.2. Core builds prior to 5.4.3 have two options:
- If possible, upgrade to AppAssure 5.4.3 and continue with this section.
- If you cannot upgrade, go the Request a No-Phone-Phone (NPH) Key section at the bottom of the Resolution.
Cores running AppAssure 5.4.3:
If you do not have active support, but have a perpetual license that allows your core to run older AppAssure builds, or cannot upgrade due other reasons such as OS/TLS/.NET limitations, patch restrictions, etc, install the QDPP plug-in or patch P-1812.
Patch P-1812 Warning: Patch P-1812 is for AppAssure 5.4.3 only. It contains Update 4 and enables the Core to use TLS 1.1 & 1.2. Installing this patch will replace any existing patch, including Update 4 (P-1612) with P-1812.
Reboot Warning: Patch P-1812 will check for .NET 4.5.2 during installation. If needed, .NET 4.5.2 will be installed. A reboot of the Core OS may be required to complete the installation. The QDPP plug-in includes P-1812.
- Install the latest OS updates.
- Check for installed AppAssure patches:
- Go to Programs and Features to see if you have AppAssure patches installed.
- If you have patches installed other than P-1612 (Update 4), go to the Request a No-Phone-Phone (NPH) Key section at the bottom of the Resolution.
- Choose to download and Install the QDPP plug-in or patch P-1812 (click the link to download):
- QDPP plug-in(recommended): Allows the Core to check into the License Portal and the Quest Data Protection Portal.
- Patch P-1812: Allows the Core to check into the License Portal.
- Install the QDPP plug-in or patch P-1812:
- DL Appliances: Stop the Core Service and Dell Storage Management Web Service before installing the plug-in.
- Run the QDPP installer or Patch msi.
- DL Appliances: After install completes, ensure the Core Service has started, and manually start the Dell Storage Management Web Service if needed.
Please Note: For customers with active support, using AppAssure 5.4.3 with the QDPP plug-in, patch P-1812, or a NPH key is only a temporary solution. If you have active support, it is suggested you upgrade to the latest version of Rapid Recovery. Support for AppAssure 5.4.3 ends on March 12, 2018. After Mach 12, we will no longer be able to take AppAssure cases until they are upgraded to Rapid Recovery.
Request a No-Phone-Phone (NPH) Key:
- Contact Support and request a no-phone-home (NPH) key.
- Once the NPH key is applied, be sure to log into the License Portal and remove the old instance of the Core to avoid Grace Period emails.