Learning Forum

[ijdavis]

We're running a network license server on a Windows machine and our security scanner is complaining that Ansys is using an unsupported certificate and is also using TLS 1.0. I'd like to be able to either ack these vulnerabilities with a "vendor says it's not an issue" or, perferably, fix them. Is there a way to use a signed cert for the Ansys license server? Is there a way to increase the TLS version to 1.2+?

[Rob]

If you log onto the Customer Portal there's a section  https://download.ansys.com/others/software_security_alerts  with further details. 

[ijdavis]

Thanks for the link, that will definitely be helpful to know about moving forward. It looks like there are no entries there for TLS or certificate issues though. Is there any documentation for those?

[Rob]

I can't comment beyond what's there, I'll kick the product team as it may be a recent issue that needs addressing. 

[ijdavis]

Hi Rob, any updates from the product team about TLS versioning?

[Rob]

Not that I'm aware of. I'll remind the Forum managers. 

[ANSYS_MMadore]

You may add this keyword to the license server's ansyslmd.ini file.

ANSYSLI_TLS_VERSION=1.2

Description: This keyword allows you to disable previous versions of TLS and enable TLS version 1.2 for communication.

Default value/range: 1.2

Corresponding command argument: -ali_tls_version

Use in combination with these ansyslmd.ini keywords: N/A

Hardware platform restrictions: N/A

Action required to make keyword active: Reread or stop and restart the Licensing Interconnect

Example: This example enables TLS version 1.2.

ANSYSLI_TLS_VERSION=1.2

[ijdavis]

Thanks for the info! Where can I find the ansyslmd.ini in the Windows folder heirarchy? I looked for .ini files and didn't see one.

[xcfje]

 

Did you manage to solve this?

We have partly same issue, as our vulnerability scanning detects a client port exposing a SHA1 root certificate, and we were also suggested to change ciphers (shrug)

 

Subject : O='ANSYS Inc'/C=US/ST=PA/L=Canonsburg/CN='ANSYS Licensing Authority Certificate'
Signature Algorithm : SHA-1 With RSA Encryption
Valid From : Oct 22 10:08:06 2008 GMT
Valid To : Oct 10 10:08:06 2058 GMT

 

Also what puzzles me is that is not on the license server, but the workstation that runs ANSYS... 

 

 

[ijdavis]

We never ended up getting a solution for this, we just accepted the risk. It would be great if we could either enter our own signed cert or have Ansys provide a cert signed by a root CA but I'm not sure it's high priority for them.

[ANSYS_MMadore]

C:\Program Files\Ansys Inc\Shared Files\Licensing. If one doesn't exist, you can create one.

[ijdavis]

Is there a way to set up a signed cert for the ansysli server that listens on 2325? We can request our own cert but I'm not seeing an obvious way to tell the server to use that instead.