Cipher configuration for ActiveGate
Dynatrace components communicate through SSL. SSL communication uses ciphers to encrypt HTTP requests. However, not all available ciphers are nowadays still considered to be secure enough. Therefore, several ciphers are by default excluded by Dynatrace (for example, all MD5, all RC4, all DES, all DSS). To check which ciphers are supported and to ensure the correct cipher naming, always use Nmap for the cipher scan on the ActiveGate process, as other tools might use a different naming syntax, while Nmap uses the same syntax as Dynatrace.
To properly configure ciphers on your ActiveGate follow the instructions below.
-
Scan the supported ciphers on the ActiveGate using Nmap. The result of the scan will be a list like the following:
PORT STATE SERVICE9999/tcp open abyss| ssl-enum-ciphers:| TLSv1.2:| ciphers:| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A| compressors:| NULL| cipher preference: server|_ least strength: A -
Exclude the unwanted ciphers by enumerating them in the
custom.properties
file of the ActiveGate. We only support pattern exclusions, so in the example below, excludingTLS_DHE_RSA_WITH_AES_256_CBC_SHA
will also excludeTLS_DHE_RSA_WITH_AES_256_CBC_SHA384
. The following example shows how to exclude the ECDHE ciphers from the above list:[com.compuware.apm.webserver]excluded-ciphers = TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256The problem with this approach is that the list becomes long and is therefore hard to maintain if the underlying OpenSSL changes. A more robust/dynamic way is to use a sub-pattern as shown in the example below.
[com.compuware.apm.webserver]excluded-ciphers = TLS_ECDHE_In this example, all cipher names that contain the string
TLS_ECDHE_
will be excluded. This pattern will exclude additional ciphers if the underlying list changes, for example due to OpenSSL updates.To exclude a suffix pattern, end the pattern string with
$
. To excludeSHA
without excludingSHA256
, specifySHA$
as a pattern. For example:[com.compuware.apm.webserver]excluded-ciphers = TLS_RSA_WITH,_SHA$Alternatively, you can define which ciphers you want to be included.
[com.compuware.apm.webserver]included-ciphers = _ECDHE_Typically, you will either define the included or the excluded ciphers but not both. Note, that if a cipher has been defined in the list of both the included as well as the excluded ones, it will be regarded as excluded. In other words, exclude takes precedence over include.