technology

UPDATE: TLS 1.2 Deprecation Testing

After the 25.06 update was released, I did a quick test of a Windows 10 VM with Smart View and EPM Automate. The concern was that TLS 1.3 is supported only on Windows Server 2022 and Windows 11 and that our customers on older versions of Windows may have issues.

The test consisted of a Hyper-V Windows 10 Enterprise Evaluation VM with MS Office 365 installed. Using a test pod with the Vision Planning sample app installed, I tried to get in and start testing around 5:30 PM CDT (22:30 UTC) but the update wasn’t pushed yet. I tried a couple of times to run the “epmautomate rundailymaintenance” command to force the update, but no luck. After 6:00 PM CDT, I tried the rundailymaintenance again and it worked.

My Smart View ad-hoc template retrieved data just fine. Similarly, EPM Automate logged in after the update and told me it needed an upgrade. I ran the upgrade command and logged out. Even after the upgrade, EPM Automate logged in just fine.

Looks like a big nothing burger, which is the best result for us all. This was a test of end user tools, so I would still recommend all of you out there in EPM land to thoroughly test after this update just to make sure everything is good.

The coming TLS-pocalypse?

On Friday, June 6, 2025, the June (25.06) update will be released. Since at least April, Oracle has been communicating that TLS 1.2 will be deprecated in favor of TLS 1.3. Transport Layer Security is used to encrypt data transfers between computers, like between your company laptop and the Oracle EPM Cloud server. TLS 1.3 has stronger encryption algorithms to safeguard that data so it makes sense that we need to update to the later standard.

Browsers have supported TLS 1.2 and 1.3 for quite some time, so no worries there. There is some ambiguity in Oracle’s statement that causes me some concern, though. In the June Update, we have the following:

Transport Layer Security (TLS) protocol version 1.2 is no longer used for connections to Oracle Fusion Cloud EPM environments; all connections are made over TLS 1.3 only. This change requires you to use a browser that supports TLS 1.3. Additionally, you need to ensure that the operating system and EPM Clients (such as EPM Automate, Smart View, and EPM Agent) that you use support TLS 1.3. The newest version of EPM Clients, and many previous versions, already support TLS 1.3.
If you integrate on-premises EPM instances with Fusion Cloud EPM using Financial Data Quality Management Enterprise Edition (FDMEE), make sure to use FDMEE version 11.2.7 or newer because older versions do not support TLS 1.3.

Over the last 15 years, I think 80% or more of my work at customers has been done on Windows client machines and servers. Many times, customers have implemented their corporate standard OS version which might not be the latest available at the time of installation. Given that information, the third sentence of the Oracle Update notes seems to indicate that the OS also needs to support TLS 1.3.

After searching on some Microsoft sites, it seems that the only flavors of Windows to support TLS 1.3 are Windows 11 and Windows Server 2022. The concern is that customers who sometimes are a little slower to adopt new technology may experience issues trying to integrate with EPM Cloud products if they are on Windows 10 or older Windows Server versions that don’t support TLS 1.3. Customers who use FDMEE on-premises instead of the EPM Integration Agent still will also want to ensure their FDMEE has been upgraded to at least 11.2.7.

We will see what happens Friday night. Hopefully it’s as non-eventful as my New Year’s Eve in 1999.

Dusting this thing off…

I read a blog post this morning by someone known as “raf,” titled The Curse of Knowing How, or; Fixing Everything, that has inspired me to share my own thoughts on the subject. Several themes from the post resonated deeply with me, especially based on my experiences in Oracle EPM and integration development over the course of my consulting career:

  • Knowing which problems are worth your energy.
  • Knowing which projects are worth maintaining.
  • Knowing when you’re building to help—and when you’re building to cope.
  • Knowing when to stop.

Early in my career, I was used to being a self-sufficient application administrator and had just enough programming knowledge to be dangerous. My first instinct was always to code my way through integration challenges.

Before I even got into Hyperion/Oracle EPM administration, I worked as an admin for a PDF report bursting tool called DocumentDirect for the Internet by Mobius Software (now owned by Rocket Software). One of our recurring challenges was maintaining monthly security updates for sensitive commission reports as managers changed roles.

To solve this, I built a quick Java application that took an HCM report and generated an XML file, which we could upload to update security roles each month. This saved a ton of time and ensured consistent role updates. It was efficient and effective—but ultimately short-lived.

The problem? I wasn’t part of IT. I was in a shadow-IT role within the Financial Systems department, reporting up through the Controller and CFO. No one else on the finance team had the technical chops to maintain what I had built. So when I left the company, my slick little Java app effectively died with me.

When I moved into EPM consulting, I brought that same mindset to client engagements. I could write elegant Python or Java solutions to streamline integration processes and save time. The downside? Many clients didn’t have the resources or the technical depth to maintain the black boxes we consultants left behind.

It takes a more mature mindset to recognize the risks of this approach. If your code breaks a year or two down the line (especially during a critical close cycle) and no one can fix it, that’s not innovation. That’s failure.

This is why the “KISS” principle (“Keep It Simple, Stupid”) can be essential in integration work. Sure, we can create all kinds of sophisticated solutions in Oracle EPM using event scripts and custom reports on integration tables. But before I do anything like that, I need to know that the client can support the customization. Additionally, the implementation partner is committed to writing the most complete, user-friendly documentation imaginable.

My goal is to share some wisdom that was given to me early in my career. It took me years to truly understand the “why” behind that advice. Hopefully, by sharing this, I can help flatten someone else’s learning curve.