Re: Feature suggestion: excludeCiphers

2014-11-13 Thread Mark Thomas
On 13/11/2014 02:58, Glen Peterson wrote: Tomcat has been one of my favorite pieces of software for about a decade. Thanks to all your generous contributions it just keeps getting better! I appreciate the focus on security in Tomcat 8. Suggestion: = Instead of specifying allowed

Re: Unable to disable SSL in Tomcat 6 for poodle Vulnerability!

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Utkarsh, On 11/12/14 5:43 AM, Utkarsh Dave wrote: Ignoring the option to upgrade to Tomcat 7, i tried to configure server.xml in several differrent ways, but yet SSL protocol was enable. I see below update on Tomcat site (

Re: Windows Service won't start

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, On 11/10/14 1:04 PM, Christopher Schultz wrote: All, When a Tomcat Windows Service won't start (with the super-helpful a service-specific error occurred), where can I look for detailed information about what happened? (Please be kind,

Re: Windows Service won't start

2014-11-13 Thread Mark Thomas
On 13/11/2014 15:51, Christopher Schultz wrote: So it looks like there is an architecture mismatch: tomcat7.exe/procrun is 64-bit and the JVM is 32-bit. We are replacing the JVM with a 64-bit one but I'm curious how to make Tomcat work on a 32-bit JVM on 64-bit Windows. I tried some Google

Re: Windows Service won't start

2014-11-13 Thread David kerber
On 11/13/2014 10:51 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, On 11/10/14 1:04 PM, Christopher Schultz wrote: All, When a Tomcat Windows Service won't start (with the super-helpful a service-specific error occurred), where can I look for detailed

Re: Windows Service won't start

2014-11-13 Thread David kerber
On 11/13/2014 11:05 AM, David kerber wrote: On 11/13/2014 10:51 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, On 11/10/14 1:04 PM, Christopher Schultz wrote: All, When a Tomcat Windows Service won't start (with the super-helpful a service-specific error

Re: Feature suggestion: excludeCiphers

2014-11-13 Thread Glen Peterson
Thank you Mark - that works great! That feature suggestion is not needed after all. I found two places where the Tomcat 8 documentation could be more helpful. I would be happy to do the following updates if I'm allowed: 1. I didn't see ciphers on this page at all (maybe it should be renamed

Re: Feature suggestion: excludeCiphers

2014-11-13 Thread Zala Pierre GOUPIL
Thanks, man! It's really helpful! On Thu, Nov 13, 2014 at 5:43 PM, Glen Peterson g...@organicdesign.org wrote: Thank you Mark - that works great! That feature suggestion is not needed after all. I found two places where the Tomcat 8 documentation could be more helpful. I would be happy to

Re: Windows Service won't start

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 11/13/14 11:04 AM, Mark Thomas wrote: On 13/11/2014 15:51, Christopher Schultz wrote: So it looks like there is an architecture mismatch: tomcat7.exe/procrun is 64-bit and the JVM is 32-bit. We are replacing the JVM with a 64-bit

Re: Feature suggestion: excludeCiphers

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Glen, On 11/13/14 11:43 AM, Glen Peterson wrote: Thank you Mark - that works great! That feature suggestion is not needed after all. I found two places where the Tomcat 8 documentation could be more helpful. I would be happy to do the

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Peter, On 11/11/14 4:03 PM, Peter Robbins wrote: Hi there, I’m running into an issue with fully-qualified domain names and https using Tomcat 8 and JDK 8. Tomcat version: 8.0.14 JDK Version: 1.8.0_25OS: Mac OS X 10.10 If you include the

Re: Feature suggestion: excludeCiphers

2014-11-13 Thread Glen Peterson
On Thu, Nov 13, 2014 at 2:23 PM, Christopher Schultz ch...@christopherschultz.net wrote: Patches are always welcome, including patches to the documentation. Let me know if you'd like to provide one, and I can give you instructions (they are pretty simple). Yes please. -- Glen K. Peterson

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-13 Thread Peter Robbins
Chris, With SSLv3 enabled it succeeds. That makes sense since SNI is only TLS. I don't have a stack trace, since the exception is handled and handshake aborted, but here's the debug output: http://pastebin.com/ShqZQVC7. Digging a little more into this I think this might be a Java issue. From

Re: Trailing dot in hostname causes TLS handshake to fail

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Peter, On 11/13/14 3:40 PM, Peter Robbins wrote: Chris, With SSLv3 enabled it succeeds. That makes sense since SNI is only TLS. I don't have a stack trace, since the exception is handled and handshake aborted, but here's the debug

Re: Feature suggestion: excludeCiphers

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Glen, On 11/13/14 3:18 PM, Glen Peterson wrote: On Thu, Nov 13, 2014 at 2:23 PM, Christopher Schultz ch...@christopherschultz.net wrote: Patches are always welcome, including patches to the documentation. Let me know if you'd like to provide

Re: JDBCRealm - Works OK but logs errors

2014-11-13 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Vince, On 11/10/14 11:02 AM, vince.w...@thomsonreuters.com wrote: I have Tomcat 8.0.9 running under NetBeans. An application using JDBCRealm is authenticating and authorising users OK but Tomcat is logging errors. I don't believe much has