SoapUI TLS 1.2

SoapUI TLS
Soon, Salesforce will be requiring all connections to be TLS v1.1 or higher.  This poses a problem for anyone using SoapUI with Java version 1.7 as that version of Java does not have TLS 1.1 or higher enabled by default.  If you attempt to connect to an instance that has the “Require TLS 1.1 or higher for HTTPS connections” enabled you will get an error like the following

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.enterprise.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <soapenv:Body>
        <soapenv:Fault>
            <faultcode>sf:UNSUPPORTED_CLIENT</faultcode>
            <faultstring>UNSUPPORTED_CLIENT: TLS 1.0 has been disabled in this organization. Please use TLS 1.1 or higher when connecting to Salesforce using https.</faultstring>
            <detail>
                <sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault">
                    <sf:exceptionCode>UNSUPPORTED_CLIENT</sf:exceptionCode>
                    <sf:exceptionMessage>TLS 1.0 has been disabled in this organization. Please use TLS 1.1 or higher when connecting to Salesforce using https.</sf:exceptionMessage>
                </sf:UnexpectedErrorFault>
            </detail>
        </soapenv:Fault>
    </soapenv:Body>
</soapenv:Envelope>

Check SoapUI Java Version

If you want to see what version of Java your SoapUI is using you can goto Help ⇨System Properties you can see an entry like

java.version=1.7.0_55

If you see something higher than 1.7 (like 1.8) then you should be fine

Setting SoapUI TLS Version

Turns out enabling TLS 1.2 for SoapUI is really easy.  You just need to add a java option to the start of SoapUI.  How to add this varies depending on your operating system but the parameter is

-Dsoapui.https.protocols=SSLv3,TLSv1.2

Linux

Doing this in Linux is a bit more complicated than it is in OSX.  You’ll want to modify the bin/soaup.sh file and add the line

JAVA_OPTS="$JAVA_OPTS -Dsoapui.https.protocols=SSLv3,TLSv1.2"

OSX

In OSX you’ll want to add the parameter to the end of the vmoptions.txt file that lives at

/Applications/SoapUI-{VERSION}.app/Contents

Windows

In Windows you’ll want to add the parameter to the end of the .vmoptions file that lives at

C:\Program Files\SmartBear\SoapUI-{VERSION}\bin\SoapUI-{VERSION}.vmoptions
This entry was posted in Development, Salesforce and tagged , , , , . Bookmark the permalink.
  • Joseph Robida

    I did as you said and still get the Unsupported_Client Error

  • Joseph Robida

    -XX:MinHeapFreeRatio=20
    -XX:MaxHeapFreeRatio=40
    -Xms128m
    -Xmx1000m
    -Dsoapui.properties=soapui.properties
    -Dsoapui.home=C:Program FilesSmartBearSoapUI-5.2.1/bin
    -Dsoapui.ext.libraries=C:Program FilesSmartBearSoapUI-5.2.1/bin/ext
    -Dsoapui.ext.listeners=C:Program FilesSmartBearSoapUI-5.2.1/bin/listeners
    -Dsoapui.ext.actions=C:Program FilesSmartBearSoapUI-5.2.1/bin/actions
    -Dwsi.dir=C:Program FilesSmartBearSoapUI-5.2.1/wsi-test-tools
    -Djava.library.path=C:Program FilesSmartBearSoapUI-5.2.1/bin
    -Djava.util.Arrays.useLegacyMergeSort=true
    -splash:SoapUI-Spashscreen.png
    -Dsoapui.https.protocols=SSLv3,TLSv1.2

  • What OS, what version of SoapUI, what version of Java?

  • Joseph Robida

    SoapUI 5.2.1

  • Joseph Robida

    Java

  • Hrm, I’ve tested this with Java 1.7 but not 1.8. I would try maybe doing

    -Dsoapui.https.protocols=”TLSv1.2″

    And maybe move it up above the -splash option. Having SSLv3 isn’t required and Poodle has kinda ended that anyway.

  • Joseph Robida

    That fixed it thanks

  • Jeff Douglas

    This is awesome! Would you mind if we potentially point the Trailhead module to this page?

  • You may absolutely point to it!

  • Anand Matta

    Event After I add the java opts soap request getting failed
    JAVA_OPTS=”-Xms128m -Xmx1024m -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -Dsoapui.https.protocols=TLSv1.2 -Dsoapui.properties=soapui.properties -Dgroovy.source.encoding=iso-8859-1 -Dsoapui.home=$SOAPUI_HOME/bin -splash:SoapUI-Spashscreen.png”
    Any help?
    I am using Ubuntu.

  • I would recommend that you add a new line after the first JAVA_OPTS that has the contents of above. Also, what version of Java do you see under the system properties in soapui?

  • It should but I don’t know for certain.

  • T Jiles

    Thank you, Patrick!

  • What operating system are you using? What version of Java? What version of SOAPui?

  • Debbie Perrott

    hi there – i’m working through a salesforce trailhead – and get this error message.
    I’m completely new to this I copied the file soapui_530 – this was a vmoptions file – I had to open it in note pad, I added in the extra line and saved I. but it still doesn’t work for me. Can someone help? https://uploads.disquscdn.com/images/fc90d45185f43506ce98de3be86f8ce1ea325c058a3c7b179ec7fd04207c168e.png

  • Looks like you have angle brackets around your protocols. This should just be

    -Dsoapui.https.protocols=SSLv3,TLSv1.2

  • Ahmad Fikri Adriansyah

    Hi Patrick,
    I’m working through salesforce trailhead and get stuck in this problem. I’ve already done as you suggested but still get the same error message
    I’m using Windows 10, my java version is 1.7.0_55 and my SoapUI version is 5.3.0

    Can you help me on this?

    These are the contents of my vmoptions file

    -XX:MinHeapFreeRatio=20
    -XX:MaxHeapFreeRatio=40
    -Xms128m
    -Xmx1000m
    -Dsoapui.properties=soapui.properties
    -Dsoapui.home=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin
    -Dsoapui.ext.libraries=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin/ext
    -Dsoapui.ext.listeners=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin/listeners
    -Dsoapui.ext.actions=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin/actions
    -Dwsi.dir=C:Program Files (x86)SmartBearSoapUI-5.3.0/wsi-test-tools
    -Djava.library.path=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin
    -Djava.util.Arrays.useLegacyMergeSort=true
    -Dsoapui.https.protocols=SSLv3,TLSv1.2
    -splash:SoapUI-Spashscreen.png

  • Valquíria Duarte D’Amato

    Eu consegui da seguinte maneira:
    1) Instalei o java mais recente.
    2) Deletei os arquivos C:Program Files (x86)SmartBearSoapUI-5.3.0jre
    3) Copiei os arquivos C:Program Files (x86)Javajre1.8.0_111 para a pasta C:Program Files (x86)SmartBearSoapUI-5.3.0jre
    4) E inclui -Dsoapui.https.protocols=SSLv3,TLSv1.2 no final do arquivo SoapUI-5.3.0.vmoptions

  • I would try dropping the SSLv3 from the list and have it read only

    -Dsoapui.https.protocols=TLSv1.2

    If that works, let me know so I can update the article. the SSLv3 may no longer be compatible.

  • Intentaría dejar caer el SSLv3 de la lista y tenerlo solamente

    -Dsoapui.https.protocols = TLSv1.2

    Si eso funciona, hágamelo saber para poder actualizar el artículo. El SSLv3 puede no ser compatible.

    (Traducido por Google translate)

  • Swapnil Borkar

    Hi Patrick
    I am getting same and I have tried all the options you mentioned in the comments to others.
    I am using SOAPUI 5.3.0
    Java 1.7
    Windows 7 professional OS.

    My file looks like following , I have tried adding -Dsoapui.https.protocols=SSLv3,TLSv1.2,
    -Dsoapui.https.protocols=”TLSv1.2″ , -Dhttps.protocols=TLSv1.1,TLSv1.2″ .
    none worked. Can you help ?

    -XX:MinHeapFreeRatio=20
    -XX:MaxHeapFreeRatio=40
    -Xms128m
    -Xmx1000m
    -Dsoapui.properties=soapui.properties
    -Dsoapui.home=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin
    -Dsoapui.ext.libraries=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin/ext
    -Dsoapui.ext.listeners=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin/listeners
    -Dsoapui.ext.actions=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin/actions
    -Dwsi.dir=C:Program Files (x86)SmartBearSoapUI-5.3.0/wsi-test-tools
    -Djava.library.path=C:Program Files (x86)SmartBearSoapUI-5.3.0/bin
    -Djava.util.Arrays.useLegacyMergeSort=true
    -splash:SoapUI-Spashscreen.png
    -Dsoapui.https.protocols=”TLSv1.2″

  • Swapnil Borkar

    ok. it finally worked after restarting SOAPUI once the vmoptions.txt file is updated.
    Thanks , and I guess you may want to add a step to restart the SOAPUI in the blog.

  • Catherine

    Hi Patrick:
    Do you have it in you for one more of same song?
    Windows 7 Enterprise environment submitting request to RHEL5 environment [TLS 1.2, AES with 128 bit encryption (High); ECDH_P256 with 256 bit exchange]
    Running SOAPUI 5.3.0 (which is packaged with java 1.7)
    I’ve remarked out the options for the SOAPUI java settings in the soapui.bat file, wanting to pick up the Java 1.8 defined to JAVA_HOME system variable. In command box, java version check yields 1.8.0 return.

    @echo off

    set SOAPUI_HOME=%~dp0
    if exist “%JAVA_HOME%” goto SET_SYSTEM_JAVA

    rem if exist “%SOAPUI_HOME%..jrebin” goto SET_BUNDLED_JAVA

    echo JAVA_HOME is not set, unexpected results may occur.
    echo Set JAVA_HOME to the directory of your local JDK to avoid this message.
    goto SET_SYSTEM_JAVA

    :SET_SYSTEM_JAVA
    set JAVA=%JAVA_HOME%..java

    rem :SET_BUNDLED_JAVA
    rem set JAVA=%SOAPUI_HOME%..jrebinjava
    goto END_SETTING_JAVA

    :END_SETTING_JAVA

    rem init classpath
    set OLDDIR=%CD%
    cd /d %SOAPUI_HOME%

    set CLASSPATH=%SOAPUI_HOME%soapui-5.3.0.jar;%SOAPUI_HOME%..lib*
    “%JAVA%” -cp “%CLASSPATH%” com.eviware.soapui.tools.JfxrtLocator > %TEMP%jfxrtpath
    set /P JFXRTPATH= < %TEMP%jfxrtpath
    del %TEMP%jfxrtpath
    set CLASSPATH=%CLASSPATH%;%JFXRTPATH%

    rem JVM parameters, modify as appropriate
    set JAVA_OPTS=-Xms128m -Xmx1024m -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -Dsoapui.properties=soapui.properties "-Dsoapui.home=%SOAPUI_HOME%" -splash:SoapUI-Spashscreen.png
    rem the below option was implemented to try and fix SOAPUI completing SSL calls
    rem set JAVA_OPTS=%JAVA_OPTS% -Dsoapui.https.protocols=TLSv1.2

    if "%SOAPUI_HOME%" == "" goto START
    set JAVA_OPTS=%JAVA_OPTS% -Dsoapui.ext.libraries="%SOAPUI_HOME%ext"
    set JAVA_OPTS=%JAVA_OPTS% -Dsoapui.ext.listeners="%SOAPUI_HOME%listeners"
    set JAVA_OPTS=%JAVA_OPTS% -Dsoapui.ext.actions="%SOAPUI_HOME%actions"
    set JAVA_OPTS=%JAVA_OPTS% -Djava.library.path="%SOAPUI_HOME%"
    set JAVA_OPTS=%JAVA_OPTS% -Dwsi.dir="%SOAPUI_HOME%..wsi-test-tools"
    rem uncomment to disable browser component
    rem set JAVA_OPTS=%JAVA_OPTS% -Dsoapui.browser.disabled="true"

    :START

    rem ********* run soapui ***********

    "%JAVA%" %JAVA_OPTS% com.eviware.soapui.SoapUI %*
    cd /d %OLDDIR%

    Additionally, the settings I have in .vmoptions =
    -XX:MinHeapFreeRatio=20
    -XX:MaxHeapFreeRatio=40
    -Xms128m
    -Xmx1000m
    -Dsoapui.properties=soapui.properties
    -Dsoapui.home=C:Program FilesSmartBearSoapUI-5.2.1/bin
    -Dsoapui.ext.libraries=C:Program FilesSmartBearSoapUI-5.2.1/bin/ext
    -Dsoapui.ext.listeners=C:Program FilesSmartBearSoapUI-5.2.1/bin/listeners
    -Dsoapui.ext.actions=C:Program FilesSmartBearSoapUI-5.2.1/bin/actions
    -Dsoapui.https.protocols=TLSv1.1
    -Dwsi.dir=C:Program FilesSmartBearSoapUI-5.2.1/wsi-test-tools
    -Djsse.enableSNIExtension=false
    -Djavax.net.debug=ssl:handshake
    -Djava.library.path=C:Program FilesSmartBearSoapUI-5.2.1/bin
    -Djava.util.Arrays.useLegacyMergeSort=true
    -splash:SoapUI-Spashscreen.png

    I tried renaming the packaged smartbear jre directory to 'jrebypass' and then pulling over the java 1.8.0 jre directory, but that yields a corrupted jre error message to occur at start of SOAPUI. With the modification above forcing the .bat to point to JAVA_HOME which is 1.8.0 version, when I go into Help under SOAPUI, it still shows 1.7 java listed there.

  • To be honest, I work on a Linux system pretty much every day. The first and only time I’ve installed SoapUI on a Windows system was to write this article. So, I’m afraid I can’t help you with getting it to use a different version of Java since my Windows knowledge is limited. Since this is probably a pretty standard thing you could probably ask on the Smart Bear site [1] and see if they can help you.

    [1] http://bit.ly/2iSGE0g

  • Daniel

    Worked great thanks. I’m working through the Trailhead SOAP module on a Mac running OSX 10.12 and SOAP-UI 5.3.0.

  • yamini

    Hi Patrick,

    I tried all the options but nothing worked. I am redirected here from trialhead module.
    My SOAPUI version is 5.3.0 and Java Version is java.version=1.7.0_55 and I am on windows 7. Any help would be greatly appreciated.
    Thanks,
    Yamini.

  • Shashwat Nandan

    If this is still not working, go to your org and search ‘Critical Updates’ in the setup. In the critical updates, Deactivate the setting that says ‘Require TLS 1.1 or higher for HTTPS connections’ and retry running the API call.

  • This will only work for a little while longer. Once Salesforce make this permanent, then there will be nothing to deactivate.

  • Prudhvi A

    Hi Daniel,

    How did you add TLS1.2 to SOAP UI. Please add exact steps here

    thanks in advance

  • Prudhvi A

    Hi Joseph,

    I have tried couple of times changing setting as you mentioned but it didn’t work.can you please provide exact steps to resolve the issue.

    Regards,
    Prudhvi

  • Justin

    States access denied when I try to save the file in Windows

  • You will need to work this out yourself. This means either you are not running as an administrator, or your configuration file is in a place that your current user (without elevated permissions) cannot access.

  • Mauri

    OSX 10.11.6 and SOAP-UI 5.3.0
    I’ve tried for a while but at the end, I had to change the soapui.sh
    here is how it looks like:
    JAVA_OPTS=”$JAVA_OPTS -Dswing.crossplatformlaf=apple.laf.AquaLookAndFeel -Dsoapui.https.protocols=TLSv1.2 -Dapple.eawt.quitStrategy=CLOSE_ALL_WINDOWS”

  • sunil kamboj

    Thanks shiva, your trick worked.

  • oussou kore

    Yes definitely you need to restart SOAPUI once the vmoptions.txt file is updated

  • Purushotham Reddy

    Thanks @grepsy:disqus this really helped. I did this on my Windows and once restarting my SOAP UI it all worked fine! – Tks again

  • Sagar Sindhi

    Hi Patrick,

    I am doing Trailhead Badge for Soap API. I am Getting TLS error when I trying to Login Using Soap UI.
    I have done all steps as you given like below image. please suggest something to fix this issue.
    https://uploads.disquscdn.com/images/f13e73ac4fa941728e8ae7a28cae3cf8dc85d531dde035690247949b4123c230.jpg

  • Did you close and restart SoapUI after editing the file?

  • Sagar Sindhi

    Yeah Patrick ! I Did it 2,3 times after Editing this file

  • Subhash V

    Hi Sagar, I guess there is a extra spaces in “SoapUI-5.3.0.vmoptions”. Just make sure there is no extra spaces and close soapui and start. It should solve issue.

  • Manish Baldota

    Hi Patrick,

    I am using WINDOWS 10 and having java version as java.version=1.7.0_55.
    I did all the changes that you suggested. but still getting the same error of TLS version in my SOAP UI.

    Please suggest how can i fix this isse

    Thank you

  • Manohar Singh Shekhawat

    Yaa, Its working fine for me too. I am also having some extra spaces. After removing these, its working fine. Restart of Soap UI required.

  • Flavio Costa Pinto

    It worked

  • Jotache

    Thanks, It works!.
    Salu2

  • Nicholas Zozaya

    Thank you very much for this – if you’re using Mac OSX right click SoapUI app and click “Show Package Contents” to find the vmoptions file

  • nitesh gadkari

    Above mentioned comment worked for me!! Thanks

  • brahmaji

    It worked for me. Thank you

  • vk

    Thanks for clear and simple instructions. This works

  • Ed

    Thanks!