MID Server TLS 1.1

[TT3]

I got following notification form ServiceNow:

Beginning with the Now Platform^® Utah release planned for March 2023, ServiceNow MID Server offering will no longer support TLS 1.1 or below.  

TLS 1.2 and newer protocols will not be impacted, and no action is needed. However, if you utilize TLS 1.1 or below, please take a moment to review the below.  

How do we know which version of TLS is being used?

Thank you.

[James Rostron2]

**Update from the case I raised with Support**

Issue:

You would like to know how to identify integrations connecting to the MID server with TLS 1.1 or below.

Solution Proposed:

You will need to log the TLS versions used during the TLS handshake inorder to identify the versions being used.

Please carry out the following steps on the test MID server to enable debugging of the TLS handshake information.

1. Using a suitable editor (such as Notepad++), edit the file: [midserver path]/agent/conf/wrapper.conf

2. Add the line below into the file and save the file.
########################################

wrapper.java.additional.53=-Djavax.net.debug=ssl,handshake

########################################

3. Restart the MID Server.

4. Confirm if you can view additional debug logging written to the file: [midserver path]/agent/logs/wrapper.log

5. Review the file wrapper.log for any requests having lower versions of TLS

[CF3]

Beautiful, thanks for that James.

[James Rostron2]

Just wondering if anyone has managed to run this yet and was it useful?

I don't have access to the host machine to do this so won't know myself first-hand.

Thanks,

James

[CF3]

I'm turning this on right now. I'll update with more info soonTM.

[CF3]

Yup, that works. In the wrapper logs you can really just do a find for "TLS" and see what comes up, or specifically "TLSv1.1" or whichever version you want to look for.

Example from mine:

"javax.net.ssl|DEBUG|16|ECCQueueMonitor.40|2022-02-28 10:29:03.217 MST|ServerHello.java:968|Negotiated protocol version: TLSv1.2"

I'll probably just leave the value in wrapper.conf active for a week or so and do some periodic searches for tlsv1.1 to see whether there are any incoming requests to look into further.