IBM Does the RRT agent support TLS 1.1/1.2 and 256-bit ciphers? - United States 256-bit ciphers; Strong Encryption; TLS 1.1; TLS 1.2; SSL; Generic Failure; Cannot support; RPT; RRT; T6; 71RRT-RPTPLAN; 71RRT-RPTINS; 71RRT-RPTCONF; 71RRT-RPTPLAY; 71RRT-RPTWV; 71RRT-RPTTS TECHNOTE (FAQ)

QUESTION
 What do you need to do to configure the Robotic Response Time (RRT) agent to support TLS 1.1/1.2 and 256-bit ciphers? 

CAUSE
Support for TLS 1.1/1.2 and 256-bit ciphers is determined by the underlying JRE (Java Runtime Environment). Consequently, in order to support TLS 1.1/1.2 and 256-bit ciphers, patch the RPT workbench JRE, and patch the RRT agent JRE. Both JREs must support the same level of TLS.

ANSWER
 

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are transport layer protocols. Ciphers implement security by providing the encryption mechanism. 

TLS is the new protocol. SSL protocol got up to version 3.0. In effect, TLS 1.0 is SSL 3.1. Currently, TLS versions include TLS 1.1 and 1.2. Each new version adds new features and modifies internal details. 

Whether the RRT agent supports TLS1.1/1.2 depends on whether the underlying JRE supports TLS 1.1/1.2. The JRE that supports the RRT agent and the JRE that supports RPT workbench must both support the same version of TLS and the same ciphers. 

For example, RRT 7.3 FP01 supports RPT 8.3.0.3, but RPT 8.3.0.3 does not support TLS1.1/1.2. Consequently, RRT 7.3 FP01 also does not support TLS 1.1/1.2.

In comparison, RRT 7.4 with IF21 or IF24 (7.4.0.0-TIV-CAMRT-IF0021 or 7.4.0.0-TIV-CAMRT-IF0024) can support RPT 8.3 and RPT 8.6 since RPT 8.6 supports TLS1.1 /1.2, and the IBM Java 7 included with RRT 7.4 also supports TLS 1.1/1.2. 

However, when a script uses TLS 1.2/1,2, some ciphers may not be supported. To verify whether certain cipher suites are supported, visit the IBM Java Knowledge Center:

IBM Java Cipher Suite Information
http://www-01.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.security.component.70.doc/security-component/jsse2Docs/ciphersuites.html?lang=en [http://www-01.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.security.component.70.doc/security-component/jsse2Docs/ciphersuites.html?lang=en]


Do You Need to Patch Java?

First, determine whether your script uses 256-bit ciphers. In RPT workbench, open the script in Test Editor mode. In the left panel, drill down through the Server Access Configurations. Select SSL.

[/support/docview.wss?uid=swg21960133&amp;aid=1]

In the right panel, examine the available ciphers that display. If the list contains 256-bit ciphers, you need to support Strong Encryption in RPT and the RRT agent. The name identifies the encryption level. For example, SSL_DHE_RSA_WITH_AES_256_CBC_SHA is a 256-bit cipher. The presence of 256 in the cipher name means that the cipher supports 256-bit encryption. 

[/support/docview.wss?uid=swg21960133&aid=2] [/support/docview.wss?uid=swg21960133&aid=2]

Cipher Naming Conventions

In RPT workbench, the cipher name always begins with "SSL" to simplify naming conventions. If the script uses TLS as the protocol in the test, then the cipher is a TLS cipher.

[/support/docview.wss?uid=swg21960133&aid=3] [/support/docview.wss?uid=swg21960133&aid=3]

Playback Symptoms

Check whether your script playbacks indicate that the RRT JRE needs to be patched to support Strong Encryption. Strong Encryption adds 256-bit ciphers.

1) The Playback Status workspace shows that playbacks are complete, but the Verification Failures workspace shows:

Event Type: Generic Failure

Violated Value: java.lang.RuntimeException occurred in IBM Registration. Message: java.io.FileNotFoundException: /tmp/RPTTEMP.A1E4CC464D3DD067D

Additional Details: none

2) The trace-robotic log includes messages like the following:

[2015-05-05T22:10:58.487-04:00] - MIN - <playback-hostname> - PlaybackThreadPoolWorker-1169 - com.ibm.tivoli.transperf.playback.rpt.RPTPlaybackService.processStatusEvent() - Sending RT VP event: i=|0|, statusEvent=|SimTestStatusEvent Values: monitorName=|<script-name>|,URL=|<monitored-url>|,eventType=|com.ibm.rational.test.lt.HTTPPageVerdict|,eventId=|516.b32|,parentEventId=|516.b27|,ownerId=|A1E4ED99F22F68E2FD5CB86461633031|,text=|Error occurred during connection to server '<server-url>'. Explanation message: 'Cannot support SSL_DHE_RSA_WITH_AES_256_CBC_SHA with currently installed providers'. Since this request is the primary request for the current page all secondary requests will be skipped and the next page will be attempted.|,name=|Primary Request verdict|,actualValue=||,expectedValue=|null|,eventVerdict=|3|,eventReason=|2|,eventDesc=|null||

Patching JREs to Support TLS 1.1/1,2

By default, RPT workbench is configured with restricted or limited strength ciphers. To use less restricted encryption algorithms, you need to download and apply the unlimited jurisdiction policy files (local_policy.jar and US_export_policy.jar). 

See Enabling Strong encryption greater than 128 bit key lengths in Rational Performance Tester
http://www.ibm.com/support/docview.wss?uid=swg21245273 [http://www-01.ibm.com/support/docview.wss?uid=swg21245273]

Use the following instructions to patch the JRE that the RRT agent uses.

Note: Backup the jar files that these steps replace -- before you replace these files.

1) Go to the IBM developerWorks Java Technology Security page for JRE 6 security information. 
See https://www.ibm.com/developerworks/java/jdk/security/ [https://www.ibm.com/developerworks/java/jdk/security/]

2) Click on the "Java SE 6" link. 

3) Click on the "IBM SDK Policy files".

4) On the Sign in page, enter your developerWorks IBM ID and password.

5) After successfully logging in, select Files for Java 5.0 SR16, Java 6 SR13, Java 6 SR5 (J9 VM2.6), Java 7 SR4, and all later releases. Click on Continue.

6) Scroll down to the License portion of the resulting page and click on the View license link to see the licensing terms for the download.

7) If the licensing terms are acceptable, check I agree and click on the I confirm link. If the terms are not acceptable, you are not able to enable strong encryption, and you should click I cancel.

8) Click on the Download now link to download the unrestricted.zip file.

9) Extract the local_policy.jar and US_export_policy.jar files from the unrestricted.zip archive.

10) Log onto the RRT agent host, and stop the RRT agent.

11) Backup the local_policy.jar and US_export_policy.jar files in the <ITM_HOME>/tmaitm6/java60/jre/lib/security and <ITM_HOME>/tmaitm6/java70/jre/lib/security directories on the RRT agent host.

12) Place those two files in the <ITM_HOME>/tmaitm6/java60/jre/lib/security and <ITM_HOME>/tmaitm6/java70/jre/lib/security directories on the RRT agent host. Replace the existing files with the same names. Verify that the file permissions are the same as the files you replaced.

13) Restart the RRT agent.

14) Try to playback the RPT script again. Does the script playback successfully, without error? 

RELATED INFORMATION
 Security information for JRE 6 [https://www.ibm.com/developerworks/java/jdk/security/]
Enabling Stong encryption greater than 128 bit key leng [http://www.ibm.com/support/docview.wss?uid=swg21245273 ]




HISTORICAL NUMBER
 34602.082.000 

PRODUCT ALIAS/SYNONYM
 ITCAMfT
T7.4
Why is RPT script for secure application failing during RRT agent playback with URL Unavailable ? 

In the ITCAM for Transactions, Robotic Response Time agent (t6) - the Rational Performance Tester (RPT) scripts playback is failing for specific secure applications (ones that use https). The scripts which invoke the http URLs work fine.

The TEP workspace Robotic Response Time -> Playback Status->Robotic Script Verification Point Failures shows following Event Types for the RPT Script when it fails:

         Script Type                                    Event Type
         
         Rational Performance Tester    HTTP Return Code
         Rational Performance Tester    Content Failure
         Rational Performance Tester    URL Unavailable Failure

What could be causing the https URLs to fail, and how to resolve this?

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are transport layer protocols. Ciphers implement security by providing the encryption mechanism. 

TLS is the new protocol. SSL protocol got up to version 3.0. In effect, TLS 1.0 is SSL 3.1. Currently, TLS versions include TLS 1.1 and 1.2. Each new version adds new features and modifies internal details. 

Whether the RRT agent supports TLS1.1/1.2 depends on whether the underlying JRE supports TLS 1.1/1.2. The JRE that supports the RRT agent and the JRE that supports RPT workbench must both support the same version of TLS and the same ciphers.