How to configure ciphers on ActiveGate

Dynatrace components communicate through SSL. SSL communication uses ciphers to encrypt HTTP requests. However, not all available ciphers are nowadays still considered to be secure enough. Therefore, several ciphers are by default excluded by Dynatrace (for example, all MD5, all RC4, all DES, all DSS). To check which ciphers are supported and to ensure the correct cipher naming, always use Nmap for the cipher scan on the ActiveGate process, as other tools might use a different naming syntax, while Nmap uses the same syntax as Dynatrace.

To properly configure ciphers on your ActiveGate follow the instructions below.

Scan the supported ciphers on the ActiveGate using Nmap. The result of the scan will be a list like the following:

Exclude the unwanted ciphers by enumerating them in the custom.properties file of the ActiveGate. The following example shows how to exclude the ECDHE ciphers from the above list:

[com.compuware.apm.webserver]  
excluded-ciphers = TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,…

The problem with this approach is that the list becomes long and is therefore hard to maintain if the underlying OpenSSL changes. A more robust/dynamic way is to use a sub-pattern as shown in the example below.

[com.compuware.apm.webserver]  
excluded-ciphers = TLS_ECDHE_

In this example, all cipher names that contain the string “TLS_ECDHE_” will be excluded. This pattern will exclude additional ciphers if the underlying list changes, for example due to OpenSSL updates.

Alternatively, you can define which ciphers you want to be included.

[com.compuware.apm.webserver]  
included-ciphers = TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

Typically, you will either define the included or the excluded ciphers but not both. Note, that if a cipher has been defined in the list of both the included as well as the excluded ones, it will be regarded as excluded. In other words, exclude takes precedence over include.