Community
Question: SSL issue
Hello,
Has WinCC OA 3.21.3 introduced a newer OpenSSL version or a higher TLS security level?
Our HTTPS communication with a Sherpa B AGV on port 9050 worked in 3.21.1 but now fails with:
error:0A00018A:SSL routines::dh key too small
Is there a configuration parameter allowing legacy DH key sizes for compatibility with existing devices?
Thanks
Responses (1)
OpenSSL 3.5 is already integrated into our current releases, specifically versions 3.19, 3.20, and 3.21.
The issue you're encountering might stem from the ciphers. We enforce a restriction to secure ciphers through a configuration entry. You can find more details about this setting here:
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/config_entries/sections/all__SPACE__sections.html#allsections__cipherSuiteList
This page outlines settings applicable across all sections.
While it's possible to enable legacy ciphers via this configuration entry, doing so means you assume full responsibility for the security of the connection.
If the ciphers aren't the root cause, then the certificate is likely the culprit. Following a BSI recommendation, we increased the default RSA key length to 3072. This change is documented as Product Backlog Item 182853: RSA keylength default increase from 2k to 3k in certificate panels.
Should you need a shorter key length, you'll have to generate a new certificate using the OpenSSL command-line interface, where you have the flexibility to specify your desired key length. The documentation for certificate creation is available at:
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/HTTP_Server/http_ssl_certs.html?hl=genrsa#http_ssl_certs__certCertStelle
When following these instructions, you would need to choose a key length other than the default 3072.
Br, Herbert