If you disable a version of TLS for Update Manager Port 8084 and you encounter problems, you can reenable the version. The process is different for port 9087.
Reenabling an earlier version of TLS has security implications.
- Stop the vSphere Update Manager service.
- Navigate to the Update Manager installation directory, which is different for 6.0 and 6.5 and later.
Version Location vSphere 6.0 C:\Program Files (x86)\VMware\Infrastructure\Update Manager vSphere 6.5 and later C:\Program Files\VMware\Infrastructure\Update Manager
- Make a backup of the vci-integrity.xml file and open the file.
- Edit the <protocols> tag.
<vmacore> <ssl> <handshakeTimeoutMs>120000</handshakeTimeoutMS> <protocols>protocols_value</protocols> </ssl> </vmacore>
- Depending on the TLS version that you want to enable, use one of the following values in the
TLS Versions to Enable Use... All
Only TLSv1.1 and TLSv.1.2
tls1.2, or do not include a protocols tag. Because the default is TLS 1.2, no protocols tag is present to start with in vmacore.
- Save the vci-integrity.xml file.
- Restart the vSphere Update Manager service.