Re: AW: 8.5.11/8.5.14 using SSLHostConfig protocols and ciphers list ignored

2017-06-23 Thread Todd 
I'm experiencing the exact same issue with 8.5.14 - cipher list seems to be
ignored, regardless of what I put in SSLAbs and validating via browser on my
website a set of ciphers is used that I have not listed.

I am able to change protocols (for instance, I can remove TLSv1 and the
system correctly makes that change), but any changes to ciphers is
completely ignored.  I've tried adding just one cipher, I've tried OpenSSL
and Standard cipher names, I've put in gibberish.  All end in the exact same
result, no errors in the log and a list of cipher suites that I did not get
to pick.

I've also validated that the ciphers that I want to use are available to
Java - using 1.8, (
http://markmail.org/message/zn4namfhypyxum23#query:+page:1+mid:zn4namfhypyxum23+state:results

 
)

Really appreciate help or direction that anyone can give!

Todd

My relevant config:




--
View this message in context: 
http://tomcat.10.x6.nabble.com/8-5-11-8-5-14-using-SSLHostConfig-protocols-and-ciphers-list-ignored-tp5062900p5064726.html
Sent from the Tomcat - User mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: AW: 8.5.11/8.5.14 using SSLHostConfig protocols and ciphers list ignored

2017-04-27 Thread Mark Thomas 
On 27/04/17 19:49, Dan Morrison wrote:



> I'm still confused by JSSE vs OpenSSL.  From all that I can figure I
> think I'm setup for JSSE Ciphers ? (not counting the above test)

The are two parts. Config style and implementation.

As much as we can, we have tried to make all combinations work so it is
easy to switch from one to the other.

To find out what is being used, look at the start logs. For example:
...Starting ProtocolHandler ["https-jsse-nio-8443"]

https = TLS is enabled
jsse  = The JSSE TLS implementation is being used
(it would be openssl if the OpenSSL implementation was used)
nio   = The pure Java NIO connector is being used
8443  = The connector is listening on port 8443

And the associated configuration is:


  

  


so I am using JSSE style config because certificateKeystoreFile is JSSE
only.

Ciphers can be specified as:
- comma separated JSSE names
- comma separated OpenSSL names
- standard OpenSSL syntax

Internally it is always stored in OpenSSL format.

If I add your cipher list to the SSLHostConfig element above and test
with SSLLabs I see the following ciphers for TLS 1.2

TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA *
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

The cipher marked with * is also available for TLS 1.1 and 1.0

Which is what I'd expect to see given I'm using an RSA cert.

If I then add
protocols="TLSv1.1+TLSv1.2"

the TLS 1.0 section for supported protocols disappears. Again as expected.

As far as I can tell, everything is working as expected.

HTH,

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: AW: 8.5.11/8.5.14 using SSLHostConfig protocols and ciphers list ignored

2017-04-27 Thread Dan Morrison 

On 04/27/2017 01:32 PM, Dan Morrison wrote:

On 04/27/2017 10:57 AM, Kreuser, Peter wrote:

Hi (WhoEverYouMayBe - you may want to sign with a name???),



Server version:Apache Tomcat/8.5.11
Server built:  Jan 10 2017 21:02:52 UTC
Server number: 8.5.11.0
OS Name:   Linux
OS Version:3.10.0-514.16.1.el7.x86_64
Architecture:  amd64
Java Home: /usr/java/jdk1.8.0_121/jre
JVM Version:   1.8.0_121-b13
JVM Vendor:Oracle Corporation
CATALINA_BASE: /opt/apache-tomcat-8.5.11
CATALINA_HOME: /opt/apache-tomcat-8.5.11
Command line argument:
-Djava.util.logging.config.file=/opt/apache-tomcat-8.5.11/conf/logging.properties 


Command line argument:
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
Command line argument: -Duser.timezone=US/Eastern
Command line argument: -Xms128m
Command line argument: -Xmx1024m
Command line argument: -Doracle.jdbc.autoCommitSpecCompliant=false
Command line argument: -Djdk.tls.ephemeralDHKeySize=2048
Command line argument:
-Djava.protocol.handler.pkgs=org.apache.catalina.webresources
Command line argument: -Djavax.net.debug=ssl:handshake
Command line argument: -Dcatalina.base=/opt/apache-tomcat-8.5.11
Command line argument: -Dcatalina.home=/opt/apache-tomcat-8.5.11
Command line argument: -Djava.io.tmpdir=/opt/apache-tomcat-8.5.11/temp

Have tested this with both 8.5.11 and 8.5.14.
There are NO logged Exceptions or errors.
Using 8.0 Connector - ssllabs.com reported TLSv1.1 and TLSv1.2
Using 9.0 SSLHostConfig - ssllabs.com reported TLSv1.0 and TLSv1.1 and
TLSv1.2
Not being able to turn off TLSv1.0 results in PCI compliance problems.

Each SSLHostConfig needs to be able to support different ciphers, since
some sites are PCI and some sites support legacy data interfaces.

I couldn't exactly figure out the expected syntax for the protocols, so
I tried... (9.0 style)
protocols="+TLSv1.1+TLSv1.2"
protocols="+TLSv1.1,+TLSv1.2"
protocols="+TLSv1.1 +TLSv1.2"
protocols="-TLSv1+TLSv1.1+TLSv1.2"
protocols="-TLSv1.0,+TLSv1.1,+TLSv1.2"

ssllabs.com ALWAYS reports the following 2 ciphers (SSLHostConfig
style). These ciphers are NOT in the ciphers list.
TLSv1.0 TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 2048 bits   FS
TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH sect571r1
(eq. 15360 bits RSA)   FS

server.xml Connector snippet (old style - don't get TLSv1.0)
  

  keystoreFile="./conf/keystore.jks" 
keystorePass="mypass"

 keyAlias="myalias1"
 clientAuth="false"
 useServerCipherSuitesOrder="true"
 sslEnabledProtocols="TLSv1.1,TLSv1.2"
ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
 (etc)
 TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />

 

   keystoreFile="./conf/keystore.jks" 
keystorePass="mypass"

 keyAlias="myalias2"
 clientAuth="false"
 useServerCipherSuitesOrder="true"
 sslEnabledProtocols="TLSv1.1,TLSv1.2"
ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
 (etc)
 TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />



server.xml SSLHostConfig snippet (9.0 style - still get TLSv1.0)
  sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation" 


 SSLEnabled="true" scheme="https" secure="true"
 defaultSSLHostConfigName="www.mydomain1.com"
 maxThreads="150" compression="false" 
enableLookups="false" >


  
  
 honorCipherOrder="true"
 protocols="+TLSv1.1+TLSv1.2"
ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
 (etc)
 TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />
  

  
  
 honorCipherOrder="true"
 protocols="+TLSv1.1+TLSv1.2"
ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
 (etc)
 TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />
  

Thanks in advanced for your help !!!


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


Apparently the following works, and from my understanding openssl- 
and java-syntax are supported from 8.5. onwards.


   sslEnabledProtocols="TLSv1.1, TLSv1.2" <-- if java is used
   protocols="TLSv1.1+TLSv1.2"<-- if openssl is used

I didn't use sslEnabledProtocols as it shows as NIO and NIO2 (deprecated)
tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support_-_Connector_-_NIO_and_NIO2 



I had read somewhere in the docs that the Connector was being made to 
use generic terms that would work for both JSSE and OpenSS, so I 
stayed away from the older terminology.


I will try as you have suggested.

Re: AW: 8.5.11/8.5.14 using SSLHostConfig protocols and ciphers list ignored

2017-04-27 Thread Dan Morrison 

On 04/27/2017 10:57 AM, Kreuser, Peter wrote:

Hi (WhoEverYouMayBe - you may want to sign with a name???),



Server version:Apache Tomcat/8.5.11
Server built:  Jan 10 2017 21:02:52 UTC
Server number: 8.5.11.0
OS Name:   Linux
OS Version:3.10.0-514.16.1.el7.x86_64
Architecture:  amd64
Java Home: /usr/java/jdk1.8.0_121/jre
JVM Version:   1.8.0_121-b13
JVM Vendor:Oracle Corporation
CATALINA_BASE: /opt/apache-tomcat-8.5.11
CATALINA_HOME: /opt/apache-tomcat-8.5.11
Command line argument:
-Djava.util.logging.config.file=/opt/apache-tomcat-8.5.11/conf/logging.properties
Command line argument:
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
Command line argument: -Duser.timezone=US/Eastern
Command line argument: -Xms128m
Command line argument: -Xmx1024m
Command line argument: -Doracle.jdbc.autoCommitSpecCompliant=false
Command line argument: -Djdk.tls.ephemeralDHKeySize=2048
Command line argument:
-Djava.protocol.handler.pkgs=org.apache.catalina.webresources
Command line argument: -Djavax.net.debug=ssl:handshake
Command line argument: -Dcatalina.base=/opt/apache-tomcat-8.5.11
Command line argument: -Dcatalina.home=/opt/apache-tomcat-8.5.11
Command line argument: -Djava.io.tmpdir=/opt/apache-tomcat-8.5.11/temp

Have tested this with both 8.5.11 and 8.5.14.
There are NO logged Exceptions or errors.
Using 8.0 Connector - ssllabs.com reported TLSv1.1 and TLSv1.2
Using 9.0 SSLHostConfig - ssllabs.com reported TLSv1.0 and TLSv1.1 and
TLSv1.2
Not being able to turn off TLSv1.0 results in PCI compliance problems.

Each SSLHostConfig needs to be able to support different ciphers, since
some sites are PCI and some sites support legacy data interfaces.

I couldn't exactly figure out the expected syntax for the protocols, so
I tried... (9.0 style)
protocols="+TLSv1.1+TLSv1.2"
protocols="+TLSv1.1,+TLSv1.2"
protocols="+TLSv1.1 +TLSv1.2"
protocols="-TLSv1+TLSv1.1+TLSv1.2"
protocols="-TLSv1.0,+TLSv1.1,+TLSv1.2"

ssllabs.com ALWAYS reports the following 2 ciphers (SSLHostConfig
style). These ciphers are NOT in the ciphers list.
TLSv1.0 TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 2048 bits   FS
TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH sect571r1
(eq. 15360 bits RSA)   FS

server.xml Connector snippet (old style - don't get TLSv1.0)
  

 

 

  



server.xml SSLHostConfig snippet (9.0 style - still get TLSv1.0)
  

  
  
 honorCipherOrder="true"
 protocols="+TLSv1.1+TLSv1.2"
 ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
 (etc)
 TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />
  

  
  
 honorCipherOrder="true"
 protocols="+TLSv1.1+TLSv1.2"
 ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
 (etc)
 TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />
  

Thanks in advanced for your help !!!


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Apparently the following works, and from my understanding openssl- and 
java-syntax are supported from 8.5. onwards.

   sslEnabledProtocols="TLSv1.1, TLSv1.2" <-- if java is used
   
	protocols="TLSv1.1+TLSv1.2"<-- if openssl is used

I didn't use sslEnabledProtocols as it shows as NIO and NIO2 (deprecated)
tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support_-_Connector_-_NIO_and_NIO2

I had read somewhere in the docs that the Connector was being made to 
use generic terms that would work for both JSSE and OpenSS, so I stayed 
away from the older terminology.


I will try as you have suggested.



 
 


I guess the (etc) is very interesting to know to be able to find the culprit of 
this finding.
Didn't think it was important since it was the exact same list of 
ciphers used with the same Tomcat version using the non-SNI Connector 
syntax.


   honorCipherOrder="true"
   protocols="TLSv1.1, TLSv1.2"
   ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
   TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
   TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
   TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
   TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
   TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
   TLS_RSA_WITH_AES_256_GCM_SHA384,
   TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
   TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
   TLS_RSA_WITH_AES_128_GCM_SHA256,
   TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
   TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" />


Also, why does the