[amar70056]

Posted via CB10

[thurask]

I heard 10.3.1 is when TLS 1.2 first came in, 10.3.2 should have it as well.

[amar70056]

Unfortunately it does not have. My office mails.are not working as my BlackBerry os 10.3.2.2474 does not support TLS 1.2 hence checking if any update came with solution since many ppl logged ticket for this issue with BlackBerry

Posted via CB10

[Vistaus]

This sounds like a question for fellow forum member Richard Buckley

Posted via CB10 using my amazing  Passport (OG Red) <3

[Ment]

I believe TLS 1.2 is only supported thru BES. So outside of that you're SOL.

[Richard Buckley]

This sounds like a question for fellow forum member Richard Buckley

Posted via CB10 using my amazing  Passport (OG Red) <3

Just browse to SSL Labs Browser Test. My Leap on 10.3.2.2876 software release 10.3.2.2836 supports TLS 1.2

[amar70056]

Thanks richard...those 2 lines are such a relief. Will test it now..also pls suggest where can I download the new autoloader for my z10 stl-1...how is the Performance of ur new version..any feedbacks will help

Posted via CB10

[amar70056]

Posted via CB10

[amar70056]

My test result..unsure what it means..pls suggest

Posted via CB10

[Richard Buckley]

My test result..unsure what it means..pls suggest

Posted via CB10

So the results indicate that your device does support TLS 1.2 (also 1.1 and 1.0) but not SSL. This is all good. I'm not sure what they mean by partially failed due to firewall restrictions. I got a similar report when I was using my home Wi-Fi (which does have a firewall). It may be that firewalls interfere with their ability to detect some of the browser vulnerabilities they are scanning for. If you did run that test on Wi-Fi, and are interested in seeing those results turn off Wi-Fi and browse there again. When I do that it does not find any vulnerabilities.

So now we are going to have to get into the weeds a bit. How exactly do you access your work email? Probably not with the browser. The email client (HUB) and browser on a BB10 device would use the same library. So if the browser supports TLS 1.2, the HUB should as well. On the other hand if you are using an Android client, the Android run time is old enough now that it may not. If you are using a native third party email client, it may also have been written to use an older protocol. It would be better if you could go through this with the person who supports your work email server, but we on CB will do what we can.

[amar70056]

Thanks for ur revert. I normally use my work email via hub (exchange active sync option) till a week ago when my company IT deactivated ssl and wanted all employees to use TLs while setup email. Now I am the only BlackBerry user in my company so I m stuck. Since I am at leadership role, I need email access very very frequently so I installed android app 'Microsoft outlook' from play store and it works fine but It does not integrated with hub so I have to go to app everytime to check mails which is not productive for me. I know that my company has a firewall between server and will need ur suggestion on what I should check with my IT to resolve this issue.

Posted via CB10

[Richard Buckley]

Thanks for ur revert. I normally use my work email via hub (exchange active sync option) till a week ago when my company IT deactivated ssl and wanted all employees to use TLs while setup email. Now I am the only BlackBerry user in my company so I m stuck. Since I am at leadership role, I need email access very very frequently so I installed android app 'Microsoft outlook' from play store and it works fine but It does not integrated with hub so I have to go to app everytime to check mails which is not productive for me. I know that my company has a firewall between server and will need ur suggestion on what I should check with my IT to resolve this issue.

Posted via CB10

I did some searching and found the discussion linked below. Not good news for you I'm afraid. But maybe it explains why so many people are so eager for the update. You may wish to have a discussion with BlackBerry support to confirm and see if you can get answers to any questions you have.

https://supportforums.blackberry.com...l/td-p/3163410

LeapSTR100-2/10.3.2.2876

[amar70056]

Thanks buddy. I also read that post during my initial research. That's why I m confused. The test shows my phone is TLS 1.2 is supported by actually it's not. I am coordinating with BlackBerry support and lets see what they do. The reason I started this thread and started looking at other forums is because after my current OS 10.3.2.2474, there are few os update releases by blackberry but they were not pushed by service provider. The latest I think is 10.3.2.2876. So I am looking at all threads to check if this new autoloader will have the TLS 1.2 support or not else no point for me to install autoloader. I could not find people mentioning about TLS status on all comment section for new os update release and they have only mentioned abt usual batt, feature, smoothness change log. Hope I get some help from BlackBerry else will have to move out of BlackBerry. I was the only loyal promoter of BlackBerry in my company and now all will feel so happy that they could get me out of BlackBerry os and move to apple or Android (which I don't want to do still). :-(

Posted via CB10

[Richard Buckley]

The post is not really that clear but the way I read it the issue is not TLS 1.2.

Here is some simple background: TLS is a protocol that is used to establish a connection potentially with encryption and authentication. I say potentially because the specifics of the connection are negotiated between the client and server. The encryption selected is usually the first common one in the configuration of the server and clients. One of the cipher suites that can be specified is no encryption. This may not sound useful, but it can be used for testing. Similarly authentication may or may not be provided. On the web an HTTPS connection the server usually authenticates to the client, but the client doesn't authenticate to the server. This is why you need a password to log onto Google.

So as I read it the issue is the cipher suite supported by the server have no matching suite on the BlackBerry. But I could be wrong about this. However if this is the case your EAS administration may be able to add a suite that has a match in the BlackBerry, at least until the update is available.

The other possibility is that a later version than you have will work. If so then your idea of using an autoloader may solve the problem. Unfortunately I don't think that there has been an update since that conversation occurred, and using an autoloader will wipe your device so you will need to backup and restore, your main memory and decrypt your SDCARD if it is encrypted, or you will loose all your data. If you still want to use an autoloader you can search or maybe Thurask can point you at one.

LeapSTR100-2/10.3.2.2876

[amar70056]

Thanks buddy. I contacted BlackBerry and they registered a ticket for me. Their team will call me for possible solution in couple of days. Will keep u updated on what they do :-)

Posted via CB10

[tipplex]

Posted via CB10

[mousse04]

what's the final word?

[mousse04]

I can answer to my own question. I'm speaking about supporting TLS 1.2 for email and so, the HUB (not the browser).

The answer is no. Why? Due to the kernel used in BB10. It is based on Android 4.1 and unfortunately, this kernel has TLS 1.2 implemented ... but disabled by default.
Here is the answer from IT guy in my company :

"Yes, there are multiple posts from BB that it’s Supported, but the reality is different when it comes to Working. As I previously mentioned, we spent weeks testing, and no old BB or Android 4.x devices work. We were unable to find any post out there where these devices worked with EAS with the TLS 1.2 requirement (InfoSec Mandated).

Starting at 4.1, TLS 1.1 and 1.2 were included, but remain Disabled, so default to 1.0.
Starting at 5.x, TLS 1.2 is enabled.
https://blog.dev-area.net/2015/08/13...1-and-tls-1-2/
The issue is the behavior of the Kernel. During the TLS handshake, the Kernel uses the Old TLS format, resulting in the failures.
From our research, the only way to override this is to Root the device in order to change those settings. Not recommended nor supported by BB, Android, or Google.
Reminder: The Kernel that BB uses is configured by Android. It doesn’t work on Android 4.x devices or BB OS.

The following is just opinion from research yesterday:
It appears BB is pushing the ‘OS10’ (BB OS in general) devices to Blackberry Enterprise Servers. I found nothing in regards to a new 5.x Kernel for the possible 10.3.4 update. There were rumors that BB is contractually obligated to keep the old Kernel for the BB OS devices with the release of their ‘Android/DTEK’ devices. Hard to confirm, but crazier things happen. Based on the simple fact that the Kernel BB OS is using is known to have 1.1 and 1.2 Disabled, yet they claim it’s Supported for EAS TLS 1.2, makes me wonder"


So, clearly, the answer is NO, HUB doesn't support and will not support TLS 1.2.
BB10 will never support TLS 1.2 while BlackBerry doesn't update the kernel (which is not likely to happen now ...)

[thurask]

Wait a minute, you're saying that BB10 uses a derivative of the Android 4.1 kernel (Linux 3.0.31)? I know getting the kernel version in the Android runtime brings up "3.2.41-QNX" or something like that, but the actual system kernel is QNX v8, which is completely different from Linux.

[mousse04]

Wait a minute, you're saying that BB10 uses a derivative of the Android 4.1 kernel (Linux 3.0.31)? I know getting the kernel version in the Android runtime brings up "3.2.41-QNX" or something like that, but the actual system kernel is QNX v8, which is completely different from Linux.

Maybe that sentence answer your question :
"The Kernel that BB uses is configured by Android"

I'm not an expert, but according to that sentence, the kernel used by BB is their own, but with limitation imposed by the android kernel.

Does it make sense?

According to that page :
http://android.stackexchange.com/que...h-linux-kernel
the 3.2.41 number doesn't mean anything

[thurask]

Does it make sense?

No, but I don't think there's a way for laymen/third parties to break open the kernel and peer inside to check.

[Richard Buckley]

Maybe that sentence answer your question :
"The Kernel that BB uses is configured by Android"

I'm not an expert, but according to that sentence, the kernel used by BB is their own, but with limitation imposed by the android kernel.

Does it make sense?

According to that page :
http://android.stackexchange.com/que...h-linux-kernel
the 3.2.41 number doesn't mean anything

No, there is no Linux kernel in BB10, certainly not in BBOS. The Android runtime kernel support is provided by the QNX kernel being able to properly respond to the Linux system calls that Android needs.

As for TLS 1.2, I run an email server which won't accept anything but TLS 1.2 connections and my BB10 devices are quite happy to send and receive email through that server.

Not sure what your IT guy is thinking.

LeapSTR100-2/10.3.2.2876

[mousse04]

No, there is no Linux kernel in BB10, certainly not in BBOS. The Android runtime kernel support is provided by the QNX kernel being able to properly respond to the Linux system calls that Android needs.

As for TLS 1.2, I run an email server which won't accept anything but TLS 1.2 connections and my BB10 devices are quite happy to send and receive email through that server.

Not sure what your IT guy is thinking.

LeapSTR100-2/10.3.2.2876

r
Could you give us more information on your server and how did you configure it?

Is it a Exchange 2013 server with EAS ?

[keliew]

What's the error that you get from the connection? Sure it's not a port issue?

Is the company server set up with specific firewall settings?

BlackBerry Passport via CB10

[mousse04]

What's the error that you get from the connection? Sure it's not a port issue?

Is the company server set up with specific firewall settings?

BlackBerry Passport via CB10

It says that the server is offline or something like that. But when I'm connecting from internal wifi network (or VPN) it works.
And if I connect with an android device, it works.