Supported protocols, ciphers, and certificates for OpenEdge clients and servers
- Last Updated: September 9, 2022
- 2 minute read
- OpenEdge
- Version 12.2
- Documentation
Supported protocols, ciphers, and certificates for OpenEdge clients and servers
In OpenEdge 12.0, an ABL socket client or server supports TLS 1.3 and can communicate with any server or client that
supports TLS 1.3.
You can use to obtain the list of default ciphers for different OpenSSL
clients, such as ABL clients and PAS for OpenEdge agents, using the following
sslc or OpenSSL command:
$DLC/bin/sslc ciphers -s <-protocol> ‘ALL’For example, to get a list of default client ciphers for the TLSv1.3 protocol, use the following command:
$DLC/bin/sslc ciphers -s -tls1_3 ‘ALL’| Protocols | Default Client Ciphers | Default Server Ciphers |
|---|---|---|
TLSv1.3 |
|
|
TLSv1.2 |
|
|
TLSv1.1 |
|
There are no default ciphers for these protocols. To use ciphers, either use the
PSC_SERVERCIPHERS_VALUE environment variable or
use the -sslprotocols connection parameter in the
CONNECT() method. |
TLSv1 |
|
There are no default ciphers for these protocols. To use ciphers, either use the
PSC_SERVERCIPHERS_VALUE environment variable or
use the -sslprotocols connection parameter in the
CONNECT() method. |
SSLv3 |
|
There are no default ciphers for these protocols. To use ciphers, either use the
PSC_SERVERCIPHERS_VALUE environment variable or
use the -sslprotocols connection parameter in the
CONNECT() method. |
For Java components, such as PAS for OpenEdge Server, OpenEdge Explorer, and OpenEdge
Management Server, you can use the following sslj command to list down
the default ciphers:
$DLC/bin/sslj list-ciphersWhen you install OpenEdge, the current default protocols are enabled. You can change the default to the other supported protocols, ciphers, or certificates. The following table lists examples of the compatibility matrix between protocols, ciphers, and certificates.
| Protocols | Ciphers | Certificates |
|---|---|---|
TLSv1.3 |
|
The default server certificate must be signed with
Do the following for the server certificate:
|
TLSv1.3 |
|
The server certificates are signed with SHA256 ($DLC/keys/default_server.pem). If you use your own
certificates, make sure they are signed with SHA256. |
TLSv1.2 |
|
Default server certificate is signed with SHA256
($DLC/keys/default_server.pem). If you use your
own certificates, make sure they are signed with
SHA256. |
TLSv1.2 |
|
The default server certificate must be signed with
Do the following for server certificates:
|
|
|
|
The server certificates must be signed with
SHA1. Do
the following:
|
The list of ciphers depend upon the ciphers supported by the vendor that you are using, for example, JSSE.
AES128-SHA256DHE-RSA-AES128-SHA256
- OpenEdge 12.1 and OpenEdge 12.0 do not support the RSA library for
TLSconnections. - OpenEdge 11.7 and later releases do not support
AES128-SHAcipher withSSLv3protocol on the AIX platform. - If you update a protocol, the supported ciphers are not updated automatically, you must update to one of the supported ciphers (as listed in the table above) for the changed protocol manually.
- If you use any
AES256-*ciphers or a server certificate on any platform with more than 2048 keysize, do the following:- Take a backup of the local_policy.jar file in your JDK installation directory (the default path is JDK_install_directory\jre\lib\security\policy\unlimited\local_policy.jar).
- Copy the local_policy.jar file from your OpenEdge installation directory ($DLC/java/ext/) to the JDK installation directory (JDK_install_directory\jre\lib\security\policy\unlimited).
- Restart the admin server and other related components.
Note: Replacing the local_policy.jar file affects the security for every product that uses the same JDK installation. If you don’t want programs other than OpenEdge to use the higher encryptions, set up one JDK installation for OpenEdge with the modified local_policy.jar, and use a different JDK installation for other products. - For information on the TLS versions supported by .NET Framework, see https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls.
- If you use Apache Web Server, see the Apache documentation for the security considerations.