TLS version supported by REST Connector and Service
Hi,
I see TLS version 1.0, 1.1, and 1.2 in the dropdown on Connect REST rule form.
Question #1. Does that mean whichever option developer choose will be actually used? Does it also depend on app server or it is only up to Pega Platform? If app server is also relevant, can someone tell me where exactly we can indicate the TLS version on Tomcat?
Question #2. Which version is used for Service REST? I do not see any option in the rule form.
Thanks,
***Edited by Moderator Marissa to update Platform Capability tags****
Accepted Solution
Updated: 19 Jun 2023 9:36 EDT
Bits In Glass
IN
- The TLS version selected on the Connect REST rule form indicates the minimum TLS version that will be used for the connection. If a higher version of TLS is available and supported by both the client and server, it will be used instead. The actual TLS version used for the connection is negotiated between the client (Pega Platform) and the server (target system) during the TLS handshake.
The TLS version support may also depend on the application server and its configuration. In the case of Tomcat, you can configure the allowed TLS versions by modifying the Tomcat server.xml configuration file. The <Connector> element includes an attribute called "sslEnabledProtocols" which can be used to specify the allowed TLS versions. For example, you can set this attribute to "TLSv1.2" to only allow connections using TLS version 1.2.
- The TLS version selected on the Connect REST rule form indicates the minimum TLS version that will be used for the connection. If a higher version of TLS is available and supported by both the client and server, it will be used instead. The actual TLS version used for the connection is negotiated between the client (Pega Platform) and the server (target system) during the TLS handshake.
The TLS version support may also depend on the application server and its configuration. In the case of Tomcat, you can configure the allowed TLS versions by modifying the Tomcat server.xml configuration file. The <Connector> element includes an attribute called "sslEnabledProtocols" which can be used to specify the allowed TLS versions. For example, you can set this attribute to "TLSv1.2" to only allow connections using TLS version 1.2.
- By default, Service REST rules use the same TLS version as specified in the Connect REST rule that is used to establish the connection to the target system. However, if you want to specify a different TLS version for a specific Service REST rule, you can do so by modifying the HTTP headers for that rule.
To specify a specific TLS version for a Service REST rule, you can add an HTTP header to the rule using the "Header" tab in the rule form. The header name should be "X-TLS-Version" and the header value should be set to the desired TLS version (e.g., "TLSv1.2"). This will override the TLS version specified in the Connect REST rule and force the Service REST rule to use the specified version. Note that this approach will only work if the target system supports the specified TLS version.
Thanks
Sumit K.