Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Peter, On 11/11/14 4:03 PM, Peter Robbins wrote: Hi there, I’m running into an issue with fully-qualified domain names and https using Tomcat 8 and JDK 8. Tomcat version: 8.0.14 JDK Version: 1.8.0_25OS: Mac OS X 10.10 If you include the

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-13 Thread Peter Robbins
Chris, With SSLv3 enabled it succeeds. That makes sense since SNI is only TLS. I don't have a stack trace, since the exception is handled and handshake aborted, but here's the debug output: http://pastebin.com/ShqZQVC7. Digging a little more into this I think this might be a Java issue. From

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Peter, On 11/13/14 3:40 PM, Peter Robbins wrote: Chris, With SSLv3 enabled it succeeds. That makes sense since SNI is only TLS. I don't have a stack trace, since the exception is handled and handshake aborted, but here's the debug

Trailing dot in hostname causes TLS handshake to fail

2014-11-11 Thread Peter Robbins
Hi there, I’m running into an issue with fully-qualified domain names and https using Tomcat 8 and JDK 8. Tomcat version: 8.0.14 JDK Version: 1.8.0_25OS: Mac OS X 10.10 If you include the trailing dot in a request over https, the TLS handshake will fail. It appears that it tries to fall back to

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-11 Thread Konstantin Kolinko
2014-11-12 0:03 GMT+03:00 Peter Robbins peter.robb...@jamfsoftware.com: Hi there, I’m running into an issue with fully-qualified domain names and https using Tomcat 8 and JDK 8. Tomcat version: 8.0.14 JDK Version: 1.8.0_25OS: Mac OS X 10.10 If you include the trailing dot in a request over

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-11 Thread Peter Robbins
I have SNI extension disabled with -Djsse.enableSNIExtension=false and SSLv3 disabled with sslEnabledProtocols=TLSv1,TLSv1.1,TLSv1.2. This should just be vanilla TLS. Peter On 11/11/14, 10:12 PM, Konstantin Kolinko knst.koli...@gmail.com wrote: 2014-11-12 0:03 GMT+03:00 Peter Robbins