com.pega.pegarules.pub.services.ConnectorException: Caught unhandled exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
Hi Team,
We are using Connect - HTTP integration in our application to integrate with another system.
As the endpoint url that we use is a https url, we had installed certificates on our linux server cacerts and pega.keystore files on our PEGA_HOME directory at least 5 months back.
However over the last 2 weeks, we have observed that we are getting the below error due to which we are not able to post request to the url.
com.pega.pegarules.pub.services.ConnectorException: Caught unhandled exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
Can you please let us know why we are getting this error even though the certificates are installed correctly.
We are using Pega 6.1 SP2.
Thanks
Accepted Solution
Pegasystems Inc.
AU
This error can occur when the service does not support the version of TLS you are attempting to connect on; if you are on TLSv1.0 please change to TLSv1.2, this is a negotiate down protocol.
I'm also suspect of the timing, there was an industry wide uplift to TLSv1.1+ at the start of July for any applications that require PCI-DSS compliance, this may be why this has changed.
Updated: 25 Jul 2018 22:43 EDT
Pegasystems Inc.
US
Hi,
Can you provide complete stack trace?
You can enable the SSL debug and share the logs (PRPC and catalina.out). This should show us why the SSL handshake is failing, is it because of the certificates or wrong configuration.
Pegasystems Inc.
PL
Hi,
Could you provide the output from the below command:
- openssl s_client -state -status -connect <host:port> | openssl x509 -text
-connect host:port - who to connect to (default is localhost:4433)
Thanks,
Lukasz
Accepted Solution
Pegasystems Inc.
AU
This error can occur when the service does not support the version of TLS you are attempting to connect on; if you are on TLSv1.0 please change to TLSv1.2, this is a negotiate down protocol.
I'm also suspect of the timing, there was an industry wide uplift to TLSv1.1+ at the start of July for any applications that require PCI-DSS compliance, this may be why this has changed.