Cipher configuration for ActiveGate
Dynatrace components communicate through SSL. SSL communication uses ciphers to encrypt HTTP requests. However, not all available ciphers are nowadays still considered to be secure enough. Therefore, several ciphers are by default excluded by Dynatrace (for example, all MD5, all RC4, all DES, all DSS). To check which ciphers are supported and to ensure the correct cipher naming, always use Nmap for the cipher scan on the ActiveGate process, as other tools might use a different naming syntax, while Nmap uses the same syntax as Dynatrace.
To properly configure ciphers on your ActiveGate follow the instructions below.
Scan the supported ciphers on the ActiveGate using Nmap. The result of the scan will be a list like the following:List of supported ciphersshell
PORT STATE SERVICE 9999/tcp open abyss | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A | compressors: | NULL | cipher preference: server |_ least strength: A
Exclude the unwanted ciphers by enumerating them in the
custom.propertiesfile of the ActiveGate. We only support pattern exclusions, so in the example below, excluding
TLS_DHE_RSA_WITH_AES_256_CBC_SHAwill also exclude
TLS_DHE_RSA_WITH_AES_256_CBC_SHA384. The following example shows how to exclude the ECDHE ciphers from the above list:shell
[com.compuware.apm.webserver] excluded-ciphers = TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
The problem with this approach is that the list becomes long and is therefore hard to maintain if the underlying OpenSSL changes. A more robust/dynamic way is to use a sub-pattern as shown in the example below.shell
[com.compuware.apm.webserver] excluded-ciphers = TLS_ECDHE_
In this example, all cipher names that contain the string
TLS_ECDHE_will be excluded. This pattern will exclude additional ciphers if the underlying list changes, for example due to OpenSSL updates.
To exclude a suffix pattern, end the pattern string with
$. To exclude
SHA$as a pattern. For example:shell
[com.compuware.apm.webserver] excluded-ciphers = TLS_RSA_WITH,_SHA$
Alternatively, you can define which ciphers you want to be included.shell
[com.compuware.apm.webserver] included-ciphers = _ECDHE_
Typically, you will either define the included or the excluded ciphers but not both. Note, that if a cipher has been defined in the list of both the included as well as the excluded ones, it will be regarded as excluded. In other words, exclude takes precedence over include.