3213296 - Error Message "received a fatal TLS protocol version alert message from the peer" in dev_icm trace

• SSL Communication can not be established
• TLS Version was recently changed
• New 3rd-party was introduced component/software
  • System can be at standstill due to SSL communication

The ICM trace file (dev_icm) or the SAP Web Dispatcher (dev_webdisp) trace file logs the following (or similar) entries:

[Thr 70366680117552] *** ERROR during secussl_read() from SSL_read()==SSL_ERROR_SSL
[Thr 70366680117552]   cli SSL session PSE "/usr/sap/SID/Dxx/sec/SAPSSLA.pse"
[Thr 70366680117552]   session ciphersuites=HIGH:MEDIUM:+e3DES:!aNULL
[Thr 70366680117552]   Client SSL_CTX 3fff70099830 pvflags=128 (TLSv1.0)
[Thr 70366680117552] secussl_read: SSL_read() failed  (536875120/0x20001070)
[Thr 70366680117552]    => "received a fatal TLS protocol version alert message from the peer"
[Thr 70366680117552] >>            Begin of Secu-SSL Errorstack            >>
[Thr 70366680117552] 0x20001070   SAPCRYPTOLIB   SSL_read
[Thr 70366680117552] SSL API error
[Thr 70366680117552] received a fatal TLS protocol version alert message from the peer
[Thr 70366680117552] 0xa0600278   SSL   ssl3_read_bytes
[Thr 70366680117552] received a fatal TLS protocol version alert message from the peer
[Thr 70366680117552] 0xa0600278   SSL   ssl3_connect
[Thr 70366680117552] received a fatal TLS protocol version alert message from the peer
[Thr 70366680117552] 0xa0600278   SSL   ssl3_read_bytes
[Thr 70366680117552] received a fatal TLS protocol version alert message from the peer
[Thr 70366680117552] <<            End of Secu-SSL Errorstack
[Thr 70366680117552]   Target Hostname="einv.exactgst.com"
[Thr 70366680117552]   SSL NI-hdl 132: local=[local IP address and port]  peer=[remote IP address and port]
[Thr 70366680117552] <<- ERROR: SapSSLSessionStartNB(sssl_hdl=3fff5c00d740)==SSSLERR_SSL_READ.

• SAP NetWeaver based system
• ABAP Platform based system
• SAP Web Dispatcher

SSL, TLS, protocol version alert , KBA , BC-CST-IC , Internet Communication Manager , BC-IAM-SSO-CCL , CommonCryptoLib , BC-CST-WDP , Web Dispatcher , BC-SEC-SSL , Secure Sockets Layer Protocol , Problem