Skip to content

Commit

Permalink
Update various markups
Browse files Browse the repository at this point in the history
  • Loading branch information
sbesson committed Sep 12, 2023
1 parent da299f5 commit 3df6c66
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 9 deletions.
15 changes: 8 additions & 7 deletions omero/sysadmins/server-upgrade.rst
Original file line number Diff line number Diff line change
Expand Up @@ -333,15 +333,16 @@ at minimum, a self-signed certificate is to use the
`OMERO server certificate management plugin <https://github.com/ome/omero-certificates>`_.
The plugin will generate or update your self-signed certificates and configure the OMERO.server.
For the configuration to take effect, the server needs to be restarted.
If you prefer to configure the OMERO server certificate manually, check:doc:`/sysadmins/client-server-ssl`.
If you prefer to configure the OMERO server certificate manually, check
:doc:`/sysadmins/client-server-ssl`.

If your server has been configured with a version of `omero-certificates` older than 0.3.0 or
manually, the configuration may need to be upgraded in particular to
If your server has been configured with a version of ``omero-certificates`` older than
0.3.0 or manually, the configuration may need to be upgraded in particular to
disallow the `deprecated TLS 1.0 and 1.1 protocols <https://datatracker.ietf.org/doc/html/rfc8996>`_.

To do so, first upgrade `omero-certificates` to version 0.3.0 or later, remove the
To do so, first upgrade ``omero-certificates`` to version 0.3.0 or later, remove the
:property:`omero.glacier2.IceSSL.Protocols` and :property:`omero.glacier2.IceSSL.ProtocolVersionMax`
configurations and finally re-execute the :cmd:`omero certificates` command:
configurations and finally re-execute the :program:`omero certificates` command::

$ pip install "omero-certificates>=0.3"
$ omero config set omero.glacier2.IceSSL.Protocols
Expand All @@ -352,8 +353,8 @@ configurations and finally re-execute the :cmd:`omero certificates` command:

On distributions with a recent version of OpenSSL (1.1+), `omero certificates` will also
enable the TLS 1.3 protocol. Note that OMERO clients will need to be upgraded to depend
on `omero-blitz` 5.7.0 or greater (Java) or `omero-py` 5.15.0 or greater (Python) in order
to negotiate this protocol with the server.
on ``omero-blitz`` 5.7.0 or greater (Java) or ``omero-py`` 5.15.0 or greater (Python)
in order to negotiate this protocol with the server.

Restart your server
^^^^^^^^^^^^^^^^^^^
Expand Down
4 changes: 2 additions & 2 deletions omero/sysadmins/troubleshooting.rst
Original file line number Diff line number Diff line change
Expand Up @@ -156,9 +156,9 @@ SSL connection issues
^^^^^^^^^^^^^^^^^^^^^

- ``javax.net.ssl.SSLHandshakeException: DH ServerKeyExchange does not comply to algorithm constraints``
- `` javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS10 is not accepted by client preferences [TLS12]``
- ``javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS10 is not accepted by client preferences [TLS12]``
- ``SSL handshake failure: The parameter is incorrect.``
- ``reason = SSL error occurred for new outgoing connection: remote address = XXX.XXX.XXX.XXX:4064 dh key too small```
- ``reason = SSL error occurred for new outgoing connection: remote address = XXX.XXX.XXX.XXX:4064 dh key too small``

These errors indicate the client is unable to establish a secure connection
with the server. Deployment platforms show a trend of making the transport
Expand Down

0 comments on commit 3df6c66

Please sign in to comment.