The error you are encountering, SSL23_GET_SERVER_HELLO:unsupported protocol, often indicates that the SSL/TLS configuration being used is attempting to negotiate an unsupported SSL/TLS version for the connection. This can occur if a server supports a newer protocol like TLS 1.3 and your implementation is limited to older versions like SSL 3.0 or TLS 1.2.
Here are some troubleshooting steps and points of consideration based on the documents:
-
Update SSL/TLS Configuration:
- Ensure your
SSLConfigurationin the%Net.HttpRequestobject is correctly configured to use the protocols supported by the server. For example:
You may need to verify that the SSL/TLS configuration namedSet request = ##class(%Net.HttpRequest).%New() Set request.SSLConfiguration = "groundca" Set request.Server = "osrd.atlassian.net" Set request.Https = 1 Set tSc = request.Get("/rest/api/2/issue/") groundcasupports the correct set of protocols (e.g., TLS 1.2 or TLS 1.3) [1][2].
- Ensure your
-
Enable Supported TLS Versions:
- If the error is due to protocol mismatch, check whether your Caché system supports the required protocols. Older versions of Caché may not support TLS 1.3, as indicated in some discussions around outdated versions [3][4]. If upgrading to a newer version is not currently an option, you could use an external tool like Stunnel in client mode to handle the TLS encryption [3].
-
Verify Server Certificate and SNI:
- If the server uses Server Name Indication (SNI), your configuration might need to explicitly include the SNI name. Some versions of Caché do not support SNI, and you may need a workaround for older setups [5]. For instance:
Set request = ##class(%Net.HttpRequest).%New() Set request.SSLCheckServerIdentity = 0
- If the server uses Server Name Indication (SNI), your configuration might need to explicitly include the SNI name. Some versions of Caché do not support SNI, and you may need a workaround for older setups [5]. For instance:
-
Troubleshoot Using
curl:- Since Curl successfully connects using TLS 1.3, it confirms that the server and API key are working as expected. Compare Curl's configurations (e.g., certificates, protocols used) with your Caché setup to identify discrepancies [1].
-
Certificate Matching:
If these steps do not resolve the issue, further analysis of the environment and possibly server-side requirements may be needed. It's also advisable to consider upgrading Caché or alternative methods to establish newer protocol support. [1][5][3][4]
Sources:
- Log in to post comments