返回
-
标题
Active Directory Virtual Lab is unable to connect to vConverter -
说明
The below errorr may occur when attempting to create a new project in ADVL and connecting to the vConverter server:
"Unable to establish a secure communication channel between the converter server and the remote machine"
Or
"Could not access the VMware vCenter Converter server. Details: The underlying connection was closed: An unexpected error occurred on a send"
Or
VmWareCenterClient.HandleException(): Type: System.ServiceModel.CommunicationException
Message: An error occurred while making the HTTP request to https:///sdk. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server..
InnerException: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream. -
原因
This occurs because VMWare vCenter Converter 6.2 (and above) disables TLS 1.0 by default because it uses RC4 encryption, which is no longer considered secure. ADVL, however, uses .Net 4.5 which by default uses TLS 1.0 -
解决办法
In order to be compatible with VMWare vCenter Converter 6.2 and above, ADVL (and thus .NET 4.5) needs to be configured to not use TLS 1.0. Instead; It should use TLS 1.1 or 1.2 and Strong Crypto by default. You can accomplish this by following the instructions in the following Microsoft article:https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client#configure-for-strong-cryptographyOr, if you are running RMAD on Windows Server 2012 R2 or later, or Windows 8.1 or later, you can simply apply the modifications needed for ADVL (and .Net 4.5) by following these steps to modify the registry on the ADVL server:NOTE: Windows Registry Disclaimer: Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.- Copy the file attached to this KB article to your ADVL server’s desktop
- Change the file extension from .txt to .reg
- Right-click on the file and choose “merge” from the pop-up menu
- On the Warning message, Click “Yes”
- On the Informational message (saying it was successfully added to the registry), click “Ok”
- Restart the ADVL console
These registry changes allow .net 4.5 to use TLS 1.1 or 1.2 (not 1.0), and instruct it to use the OS defaults (which on a patched Windows Server 2012 R2 or later is TLS 1.2).To manually modify the registry:- Open Regedit
- Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
- Create DWORD with the name SchUseStrongCrypto and value of 1
- "SystemDefaultTlsVersions"=dword:00000001
- Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319
- Create DWORD with the name SchUseStrongCrypto and value of 1
- "SystemDefaultTlsVersions"=dword:00000001
-
附件
-
其他信息
The questsoftware.recoverymanager.ad.presentation.log may have an error similar to the following: QuestSoftware.RecoveryManager.AD.Cloning.ConverterConnectionFailedException: Could not access the VMware vCenter Converter server. Details: The underlying connection was closed: An unexpected error occurred on a send. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.