DataPower

DataPower

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  DataPower - TLS library error - bad length

    Posted 11/27/24 07:31 PM

    Hello,

    For APIGateway service which is not managed through APIConnect, seeing this error intermittently while DataPower connects to an https backend API. 

    The 'AssemblyActionInvoke' configured doesn't have any SSLClient configured explicitly. 

    Is 'api-ssl-client-all' some sort of default tls client, where can it be found? 

    [ssl][error] ssl-client(api-ssl-client-all): tid(...) gtid(....): TLS library error: error:1409E10F:SSL routines:ssl3_write_bytes:bad length

    Error occurred while writing to next processing stage.

    Error in stream. Descriptor number unavailable. Additional information: Write error (8)

    Found this article related to this fix 'IT45793: TLS BAD LENGTH ERROR WHEN USING TLS VERSION 1.3 AND SESSION CACHING.'

    Is there a default tls profile where the session caching field this article talks about can be switched off? 



    ------------------------------
    Asim Khan
    ------------------------------


  • 2.  RE: DataPower - TLS library error - bad length

    Posted 11/28/24 01:46 AM

    Hello, I know this error and had a support case concerning this.

    There is a default tls client profile called "api-sslcli-all", but disabling session caching here won't workaround the issue. 
    From support: "As mentioned on my last update, api-sslcli-all is an artifact from an old version that does not support TLS1.3. As such, disabling session caching will not be a viable workaround for this object."

    Disabling session caching only works in custom tls client profiles (which appear internally as "api-ssl-client-all")

    So we had to apply 10.5.0.12 where IT45793 is fixed (or 10.6.0.1)

    Regards, Uli



    ------------------------------
    Uli Rauscher
    ------------------------------



  • 3.  RE: DataPower - TLS library error - bad length

    Posted 11/28/24 09:18 AM

    Uli,

    Talking about the custom client profile, for the AssemblyActionInvoke, SSLClient is not explicitly configured under it. So does it mean it's using the implicit tls client profile if there is any, which I am not able to find? Another point to note it works intermittently. Thanks 



    ------------------------------
    Asim Khan
    ------------------------------

    Original Message


  • 4.  RE: DataPower - TLS library error - bad length

    Posted 11/28/24 09:32 AM

    Hi,

    if you mean Configuring the Invoke policy for DataPower API Gateway - IBM Documentation with "AssemblyActionInvoke", yes you are right.

    Using an own (custom) TLS client profile in your yaml
    - invoke:
        <...>
        tls-profile: MyTLSProfile:1.0.0
        <...>
    disabling session in MyTLSProfile:1.0.0 worked.

    If you don't use "tls-profile" in your invoke action at all, default profile "api-sslcli-all" is used. You can see it in the list of TLS client profiles, you can disable TLS session in it, but it won't have any effect.

    And yes, the issue appeared intermittently, as far as I remember.

    Regards, Uli



    ------------------------------
    Uli Rauscher
    ------------------------------

    Original Message


  • 5.  RE: DataPower - TLS library error - bad length

    Posted 11/28/24 12:22 PM

    In this case APIGateway is manually managed and not being externally managed by APIConnect. 

    No default profile 'api-sslcli-all' listed under 'Configure TLS client profile' page (Objects > Crypto Configuration > TLS client profile). 

    Does this 'api-sslcli-all' reside somewhere else in the domain. 



    ------------------------------
    Asim Khan
    ------------------------------

    Original Message


Related Content