​Hi
I have a strategy designed in IRD, where I'm using a Web Service object to send a http POST to an external web server. This means, that the connection is made from the URS to the external web server.
It has been working for a couple of years, but now the support for http will soon be disabled, so I need to use https instead.
I thought, that it would just be changing http to https in the URL, and then everything like trusting the certificate etc. would be handled by the Windows built-in trust store. But it doesn't work...
Reading the Genesys documentation on the issue have not really helped me.
On the server, where URS is running, I have tested using Posman. It works, which should mean, that any firewall etc. should be open for https traffic.
Does anybody know, what I'm missing?
#Security

------------------------------
Gert Sogaard
------------------------------

May not be related, but it's worth checking what version of TLS is being negotiated and allowed.  I spent a fair bit of time a few years ago in trying to identify if Cert thumbprint info needed to be entered in the URS config, looking at upgrading URS.  Most of what I seem to recall was that a lot of certificate manual stuff needed was for Linux installs.

Ultimately the two lessons we learned were:

1. You need to make sure your URS host can access the CRL repository for the certificates being presented
2. You need to be sure your URS host has the TLS level required enabled that is needed on the remote side.

------------------------------
Vaun McCarthy
NTT New Zealand Limited
------------------------------

Original Message:
Sent: 08-14-2020 07:51
From: Gert Sogaard
Subject: How to use https in IRD WebService

​Hi
I have a strategy designed in IRD, where I'm using a Web Service object to send a http POST to an external web server. This means, that the connection is made from the URS to the external web server.
It has been working for a couple of years, but now the support for http will soon be disabled, so I need to use https instead.
I thought, that it would just be changing http to https in the URL, and then everything like trusting the certificate etc. would be handled by the Windows built-in trust store. But it doesn't work...
Reading the Genesys documentation on the issue have not really helped me.
On the server, where URS is running, I have tested using Posman. It works, which should mean, that any firewall etc. should be open for https traffic.
Does anybody know, what I'm missing?
#Security

------------------------------
Gert Sogaard
------------------------------

Original Message:
Sent: 8/15/2020 3:06:00 AM
From: Vaun McCarthy
Subject: RE: How to use https in IRD WebService

May not be related, but it's worth checking what version of TLS is being negotiated and allowed.  I spent a fair bit of time a few years ago in trying to identify if Cert thumbprint info needed to be entered in the URS config, looking at upgrading URS.  Most of what I seem to recall was that a lot of certificate manual stuff needed was for Linux installs.

Ultimately the two lessons we learned were:

1. You need to make sure your URS host can access the CRL repository for the certificates being presented
2. You need to be sure your URS host has the TLS level required enabled that is needed on the remote side.

------------------------------
Vaun McCarthy
NTT New Zealand Limited
------------------------------

Original Message:
Sent: 08-14-2020 07:51
From: Gert Sogaard
Subject: How to use https in IRD WebService

​Hi
I have a strategy designed in IRD, where I'm using a Web Service object to send a http POST to an external web server. This means, that the connection is made from the URS to the external web server.
It has been working for a couple of years, but now the support for http will soon be disabled, so I need to use https instead.
I thought, that it would just be changing http to https in the URL, and then everything like trusting the certificate etc. would be handled by the Windows built-in trust store. But it doesn't work...
Reading the Genesys documentation on the issue have not really helped me.
On the server, where URS is running, I have tested using Posman. It works, which should mean, that any firewall etc. should be open for https traffic.
Does anybody know, what I'm missing?
#Security

------------------------------
Gert Sogaard
------------------------------