SSL/TLS unsupported protocol error

The error you are encountering, SSL23_GET_SERVER_HELLO:unsupported protocol, often indicates that the SSL/TLS configuration being used is attempting to negotiate an unsupported SSL/TLS version for the connection. This can occur if a server supports a newer protocol like TLS 1.3 and your implementation is limited to older versions like SSL 3.0 or TLS 1.2.

Here are some troubleshooting steps and points of consideration based on the documents:

1. Update SSL/TLS Configuration:

   • Ensure your SSLConfiguration in the %Net.HttpRequest object is correctly configured to use the protocols supported by the server. For example:

     Set request = ##class(%Net.HttpRequest).%New()
     Set request.SSLConfiguration = "groundca"
     Set request.Server = "osrd.atlassian.net"
     Set request.Https = 1
     Set tSc = request.Get("/rest/api/2/issue/<issue-name>")
     

     You may need to verify that the SSL/TLS configuration named groundca supports the correct set of protocols (e.g., TLS 1.2 or TLS 1.3) [1][2].

2. Enable Supported TLS Versions:

   • If the error is due to protocol mismatch, check whether your Caché system supports the required protocols. Older versions of Caché may not support TLS 1.3, as indicated in some discussions around outdated versions [3][4]. If upgrading to a newer version is not currently an option, you could use an external tool like Stunnel in client mode to handle the TLS encryption [3].

3. Verify Server Certificate and SNI:

   • If the server uses Server Name Indication (SNI), your configuration might need to explicitly include the SNI name. Some versions of Caché do not support SNI, and you may need a workaround for older setups [5]. For instance:

     Set request = ##class(%Net.HttpRequest).%New()
     Set request.SSLCheckServerIdentity = 0
     

4. Troubleshoot Using curl:

   • Since Curl successfully connects using TLS 1.3, it confirms that the server and API key are working as expected. Compare Curl's configurations (e.g., certificates, protocols used) with your Caché setup to identify discrepancies [1].

5. Certificate Matching:

   • Ensure the server name matches the values in its SSL certificate. Sometimes mismatches arise from redirects or incorrect configuration, which can result in an SSL handshake failure [1][5].

If these steps do not resolve the issue, further analysis of the environment and possibly server-side requirements may be needed. It's also advisable to consider upgrading Caché or alternative methods to establish newer protocol support. [1][5][3][4]

Sources:

First thing that comes to mind is disabling TLS 1.1 as that is deprecated. For TLS 1.3 (if that's required) you'll need to migrate to IRIS ( being on Cache 2017 probably has other security implications that would be remedied by upgrading at least to Cache latest.)

You might be able to find out more about this issue using ^REDEBUG as discussed in another post on the community, else support can probably help look into what the issue is. It's been a bit since I've worked on something like this myself.