Encryption of communications between Embedded Security: Critical System Protection (SES:CSP) Manager and the database server.
search cancel

Encryption of communications between Embedded Security: Critical System Protection (SES:CSP) Manager and the database server.

book

Article ID: 164725

calendar_today

Updated On:

Products

Embedded Security Critical System Protection Data Center Security Server Advanced Data Center Security Server

Issue/Introduction

You want to know if Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt data that is transmitted across a network between an instance of SQL Server and the Symantec Embedded Security: Critical System Protection (SES:CSP) Manager and how to configure it.

Environment

More information regarding SQL encryption : 

https://technet.microsoft.com/en-us/library/ms189067(v=sql.105).aspx

Applies to Symantec Embedded Security: Critical System Protection up to version 8.0.2.

Data Center Security Server, Data Center Security Server Advanced (Data Center Security Server Advanced 6.9.x

Resolution

To enable communication encryption :

  • Edit the server.xml located in C:\Program Files (x86)\Symantec\Symantec Embedded Security\Server\tomcat\conf
    • Find the default URL: url="jdbc:jtds:sqlserver://192.0.2.50/SCSPDB;instance=SCSP"
    • Change it to: url="jdbc:jtds:sqlserver://192.0.2.50/SCSPDB;instance=SCSP;ssl=require"
  • Modify the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apache Software Foundation\Procrun 2.0\SISManager\Parameters\Java
    • In options append the following at the end: -Djsse.enableCBCProtection=false
  • Restart the manager ( Service name = Symantec Embedded Security: Critical System Protection Manager )
  • After the manager restarts, go to  : C:\Program Files (x86)\Symantec\Symantec Embedded Security\Server\tomcat\logs
  • Open the sis-server.0.log and verify there are no errors logged when the manager started.

WARNING : If you are upgrading SES:CSP to a newer version, you have to disable encryption for the upgrade. (Re-enable it after.)