The following are the important changes you must understand before starting the migration.
The product now supports TLS 1.3 alongside TLS 1.2.
Cipher suites have been updated to align with OpenSSL 3.0 and include the following TLS 1.3 Ciphers suites:
TLS_AES_256_GCM_SHA384.
TLS_CHACHA20_POLY1305_SHA256 (non-FIPS only).
TLS_AES_128_GCM_SHA256.
TLS 1.2 Ciphers continue with a mix of AES and RSA encryption options.
IMPORTANT:Configure the environments requiring TLS 1.3 accordingly. Ensure to remove or update any deprecated or outdated cipher suites.
In OpenText eDirectory 9.3, the FIPS mode is disabled by default. However, you can enable it according to the NICI (Novell International Cryptographic Infrastructure) configuration. This is applicable for TLS FIPS and NICI FIPS. In the earlier version of the product, TLS FIPS is enabled by default.
The NICI configuration file, nici64.cfg becomes the reference point for enabling TLS FIPS and NICI FIPS. For more information see, Operating eDirectory in FIPS Mode.
IMPORTANT:For systems requiring FIPS compliance, review the NICI configurations. If upgrading from 9.2, expect different default behaviors in TLS-FIPS settings.
OpenText eDirectory 9.3 no longer supports the following:
RSA certificates with key sizes of 512, 768, or 1024 bits in the FIPS mode.
SHA-1 certificates in the FIPS mode in OpenText eDirectory 9.3. However, these are supported in the non-FIPS configurations.
DES and RC2-40 in the FIPS or non-FIPS environments. However, 3DES remains supported in the FIPS mode.
IMPORTANT:Review and update certificates and encryption configurations, especially if small key sizes or SHA-1 certificates are used.
A fresh installation of OpenText eDirectory 9.3 automatically creates an AES 256-bit tree key (CN=W1.CN=KAP.CN=Security). However, when upgrading from older OpenText eDirectory versions, the existing tree key remains unchanged and continue to function as expected. For more details about NICI keys, see Understanding the NICI Keys
NOTE:If you are planning on upgrading the eDirectory to 24.4(v9.3) and if 56 bit / DES tree keys exist in the tree, then for guidance on identifying and migrating away from 56-bit keys, refer to the following TID: KM000040457.
OpenText eDirectory 9.3 supports only the following versions of these products. Upgrade if you are using older versions.
OpenText Identity Console 24.4 (v1.9)
OpenText Identity Manager 24.4 (v4.10)
IMPORTANT:Verify the integrations with these products for version compatibility before upgrading. Older versions might cause installation failures or communication issues.