Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 James, On 2/6/19 12:21, James H. H. Lampert wrote: > Thanks. I do have some follow up questions > > On 2/6/19, 1:04 AM, Mark Thomas wrote: >> On the TLS Connector: >> >> sslEnabledProtocols="TLSv1.1,TLSv1.2" > > Ok. So the active connector we

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread Mark Thomas
On 06/02/2019 17:21, James H. H. Lampert wrote: > Thanks. I do have some follow up questions > > On 2/6/19, 1:04 AM, Mark Thomas wrote: >> On the TLS Connector: >> >> sslEnabledProtocols="TLSv1.1,TLSv1.2" > > Ok. So the active connector we currently have for this particular > installation (which

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread James H. H. Lampert
Thanks. I do have some follow up questions On 2/6/19, 1:04 AM, Mark Thomas wrote: On the TLS Connector: sslEnabledProtocols="TLSv1.1,TLSv1.2" Ok. So the active connector we currently have for this particular installation (which has multiple IP addresses, hence the "address" clause) is:

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark and James, On 2/6/19 04:04, Mark Thomas wrote: > On 05/02/2019 23:49, James H. H. Lampert wrote: >> We've just received word from a customer that they had two >> vulnerabilities flagged on a security scan of the box their >> Tomcat server is

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread Mark Thomas
On 05/02/2019 23:49, James H. H. Lampert wrote: > We've just received word from a customer that they had two > vulnerabilities flagged on a security scan of the box their Tomcat > server is running on. > > 38628 - TLS 1.0 still supported. > Ok, assuming that the box and the JVM can go up to a

TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-05 Thread James H. H. Lampert
We've just received word from a customer that they had two vulnerabilities flagged on a security scan of the box their Tomcat server is running on. 38628 - TLS 1.0 still supported. Ok, assuming that the box and the JVM can go up to a more current TLS level, and a more current cipher, what do