AP9631 -cannot access NMC via HTTPS

[BillP]

Dear 4rum,

Recently, I just enabled a HTTPS to access APC NMC but it cannot immediately, before I have access it by HTTP only. Here is what I tried but nothing changes:

- Did a hard reset button of NMC 

- Access it via serial cable by Putty but it is a black screen only without any information.

- Already enabled TLS1.x and SSL 2 and 3.0 but still cannot.

- Try to access it by chrome but the same issue with error show as unsupport protocol.

Could you please advise what should I do to solve it?

Many Thanks, Huan

[BillP · Accepted solution]

Hello Huan,

Good day to you. Have you checked the article regarding this? I have the link below:

http://www.apc.com/us/en/faqs/FA238115/

[BillP]

Thanks Allen for your prompt support.

But the resolution is enable SSL 3.0 on IE11 does not resolved, and luckily I have access it via https by downgrade my IE to v8 (instead of v11) 🙂

Now I have to set back to http and also enable ssh as second access to my AP9631.

But what is difference as Ap9631 and AP9537SUM since I can access by httpS to my AP9537SUM normally with IE11 with a same IE settings?

[BillP]

Huan,

They are basically the same but the only difference is the part number. AP9537SUM is for the embedded NMC on the UPS and AP9631 is the actual card that you can remove from the UPS and use to different UPS.

[BillP]

Huan - what AOS and app version is on your AP9631? And what version of Chrome are you using?

Assuming modern firmware version, HTTPS should be working properly with modern browsers. We recently discovered an issue with Chrome v55 and newer though which sometimes causes the HTTPS handshake to fail because of how Chrome is advertising ciphers. If you refresh or try a new session a few times, then HTTPS works. We will be fixing this in our next firmware version with a tweak to better work with Chrome specifically. We'll be writing a knowledge base article on this topic this week.

If you have older firmware versions, you may not have the latest versions of TLS enabled but it sounds like you've said you have specifically set them in the interface. I took this to mean that maybe you've set the minimum protocol version if the NMC? Please clarify.

[BillP]

My AP9631 with Firmware Revision: 5.1 (ID5).

My chrome version  45.0.2454.85 m and 55.0.2883.87 m are using on both windows server 2008 and W7. All of them cannot access my AP9631 by https.

Thanks for your advice.

[voidstar_apc · Accepted solution]

Hi Huan,

5.1 (ID5) is the firmware version of the ups. To determine the firmware version of the NMC AOS and SUMX, look in about->networking

[BillP]

I am sorry for my wrong information. Below is my AP9631 info:

APC OS (AOS)
Version: v5.1.7
Date: Nov 22 2011
Time: 09:53:57

APC Boot Monitor
Name: bootmon
Version: v1.0.2
Date: Jan 21 2010
Time: 13:35:57

[voidstar_apc]

Hi Huan,

v5.1.7 is an older version of AOS. Latest version is 6.4.6. You can get a copy here:

http://www.apc.com/us/en/tools/download/

Select "Firmware Upgrades - UPS Network Management Card". Then download the file "UPS Network Management Card v6.4.6 Firmware for Smart-UPS & Galaxy 3500 with AP9630/31/35"

[BillP · Accepted solution]

Yes, as voidstar mentioned, v5.1.7 is very old and likely won't work with modern versions of browsers using HTTPS because only SSLv3 was supported when that was released and that protocol has been since blocked by most if not all web browsers due to security vulnerabilities.

I suggest to re-try with AOS 6.4.6 too. Be advised that upgrading to 6.X.X firmware is a "major" change as the web user interface will be different to start. Other changes are listed here for your FYI-> http://www.apc.com/us/en/faqs/FA167693

[BillP]

Many thanks for voidstar and Angela's supporting and great explanation.

I am fine with my current AOS v5.1.7  as I said now I have both of access my AP9631 by HTTP and SSH 🙂

Now I am having a good experience with my new AP9537SUM that running a AOS v6.4.0.