cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
847
Views
2
Helpful
3
Replies

Can you set the TLS SNI host name in a UCCX rest call?

Clifford McGlamry
Spotlight
Spotlight

I have a customer that has a script making a REST call that is failing.  In troubleshooting, the customer's security people are saying it's failing because UCCX is not sending the TLS SNI field in the TLS hello, and because of this their FortiWeb doesn't know what server to route the request to.  

This is a new one to me.  Has anyone else run across this?  Is this even possible?

1 Accepted Solution

Accepted Solutions

Clifford McGlamry
Spotlight
Spotlight

Well, a coworker sent me this:   https://bst.cisco.com/bugsearch/bug/CSCwb74848

Apparently, it's not currently supported.

 

View solution in original post

3 Replies 3

Clifford McGlamry
Spotlight
Spotlight

Well, a coworker sent me this:   https://bst.cisco.com/bugsearch/bug/CSCwb74848

Apparently, it's not currently supported.

 

mparra.fusionet
Beginner
Beginner

Hi @Clifford McGlamry, I opened a TAC case because I ran exactly into the same thing, the bug is quite misleading, our client has AS and they were able to find that there is a Patch, I am waiting on them to verify the packet capture and UCCX logs showing that the SNI is not being sent in the TLS Client Hello to provide the patch to test it

mparra.fusionet
Beginner
Beginner

Finally I was able to get TAC to do the workaround on the Linux OS root and it is working!, It is key to be at 12.5.1 SU3 minimum to apply this workaround otherwise it won't work,  at some point they will have a patch but if anybody runs into this issue, please contact TAC and ask for the manual workaround (jar file that needs to be copied via the UCCX Linux root).

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: