Return
-
Title
When connecting Safeguard for Privileged Sessions (SPS) to HPE BladeSystem the connection fails and the following error is reported in the logs ‘illegal parameter’ -
Description
When connecting Safeguard for Privileged Sessions (SPS) to a HPE BladeSystem the connection fails and the following error is reported in the logs+++++++++And the following error is reported in a network trace between the SPS and the target server.
2022-09-16T14:43:18+02:00 <target.dom.com> zorp/scb_http[151758]: core.info(4): (svc/5q9fxM1dKV2PJpqsXpi4kH/https_test:3/http): TLS alert received; operation='write', alert_type='fatal', alert_reason='illegal parameter'
++++++++++++++++++
2022-09-16T12:20:57+02:00 <target.domain.com> zorp/scb_http[151758]: core.error(1): (svc/tm46BFnsBftnCrfRyMGmku/https_test:1/http): SSL handshake failed; side='server', error='error:141A417A:SSL routines:lib(20):tls_process_ske_ecdhe:func(420):wrong curve:reason(378), supressed 1 messages'
+++++++++ -
Cause
The network trace between the SP and the target system shows that during TLS 1.2 handshake, SPS sends a "client hello" message first, which contains an extension called "supported_groups". This extension describes elliptic curves (EC) supported by SPS and it contains only one item: “secp256r1”
The target system responds with a "server hello" message, and during server key exchange, the server uses an elliptic curve called “secp384r1”.
Since the elliptic curve used by the target server does not match the elliptic curve requested by SPS, the handshake fails with error message "wrong curve".
-
Resolution
There isn’t any option in SPS to change the EC, therefore the target server needs to be reconfigured to enable EC "secp256r1".
-
Additional Information
Change request PAM-17195 has been raised to address this in a future release of the Safeguard for Privileged Sessions.