Re: SSL issue in tomcat

2015-02-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jason, On 2/2/15 4:46 AM, Jason Y wrote: > Thanks for your reply, Chris. > > I am providing solr search service on Linux server. My java version > is 1.7_67(64bit) and tomcat version is 7.0.55 and tomcat Connector > is: protocol="org.apache.coyote

Re: SSL issue in tomcat

2015-02-02 Thread Jason Y
Thanks for your reply, Chris. I am providing solr search service on Linux server. My java version is 1.7_67(64bit) and tomcat version is 7.0.55 and tomcat Connector is: In my service I provide both REST and WSDL servie to call solr search by https. Everything worked well until one day(about in No

Re: SSL issue in tomcat

2015-01-23 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jason, On 1/23/15 3:27 AM, Jason Y wrote: > Thank you Chris for your reply. > > I think I was mislead by this error. My services--both REST and > SOAP--are hosted by tomcat and used by downstream users with HTTPS. > They are running well for long t

Re: SSL issue in tomcat

2015-01-23 Thread Jason Y
g message for this. And, I didn't find > >> much request to the service. Currently there are no changed > >> settings(firewall/network, etc.). > >> > >> On Wed, Jan 21, 2015 at 11:28 PM, Jeffrey Janner < > >> jeffrey.jan...@polydyne.com

Re: SSL issue in tomcat

2015-01-22 Thread Christopher Schultz
ly there are no changed >> settings(firewall/network, etc.). >> >> On Wed, Jan 21, 2015 at 11:28 PM, Jeffrey Janner < >> jeffrey.jan...@polydyne.com> wrote: >> >>>> -Original Message- From: Jason Y >>>> [mailto:day...@gmail.com] S

Re: SSL issue in tomcat

2015-01-21 Thread Jason Y
> > -Original Message- >> > From: Jason Y [mailto:day...@gmail.com] >> > Sent: Wednesday, January 21, 2015 12:44 AM >> > To: Tomcat Users List >> > Subject: Re: SSL issue in tomcat >> > >> > Got another issue...Tomcat is working fi

Re: SSL issue in tomcat

2015-01-21 Thread Jason Y
e: > > -Original Message- > > From: Jason Y [mailto:day...@gmail.com] > > Sent: Wednesday, January 21, 2015 12:44 AM > > To: Tomcat Users List > > Subject: Re: SSL issue in tomcat > > > > Got another issue...Tomcat is working fine after restart but i

RE: SSL issue in tomcat

2015-01-21 Thread Jeffrey Janner
> -Original Message- > From: Jason Y [mailto:day...@gmail.com] > Sent: Wednesday, January 21, 2015 12:44 AM > To: Tomcat Users List > Subject: Re: SSL issue in tomcat > > Got another issue...Tomcat is working fine after restart but it cannot > last > long.

Re: SSL issue in tomcat

2015-01-21 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jason, On 1/21/15 4:29 AM, Jason Y wrote: > Here is what I get with openssl s_client command: > > Loading 'screen' into random state - done CONNECTED(01E8) write > to 0x2103650 [0x2103698] (124 bytes => 124 (0x7C)) - 80 7a 01 > 03 01 00 51

Re: SSL issue in tomcat

2015-01-21 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jason, On 1/20/15 8:53 PM, Jason Y wrote: > Thank you all. Now it is working fine. > > protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" > SSLEnabled="true" scheme="https" secure="true" clientAuth="false" > sslProtocol="TLS" sslE

Re: SSL issue in tomcat

2015-01-21 Thread Jason Y
Here is what I get with openssl s_client command: Loading 'screen' into random state - done CONNECTED(01E8) write to 0x2103650 [0x2103698] (124 bytes => 124 (0x7C)) - 80 7a 01 03 01 00 51 00-00 00 20 00 00 39 00 00 .zQ... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0

Re: SSL issue in tomcat

2015-01-21 Thread Sanaullah
then may be its not the issue of tomcat.you can check you firewall? may be your firewall dropping the correction after some time. try to connect the server from localhost using " openssl s_client -connect hostname:8443 -debug " may be you will found something use full. On Wed, Jan 21, 2015 at 11:

Re: SSL issue in tomcat

2015-01-20 Thread Jason Y
Got another issue...Tomcat is working fine after restart but it cannot last long. Now I cannot access https pages with any browsers. I didn't find anything useful in logs. After a restart, it works well again. On Wed, Jan 21, 2015 at 10:01 AM, Sanaullah wrote: > its not necessary to hav

Re: SSL issue in tomcat

2015-01-20 Thread Sanaullah
its not necessary to have ciphers properties but if you want to restrict the ciphers then you can use this property. On Wed, Jan 21, 2015 at 6:53 AM, Jason Y wrote: > Thank you all. Now it is working fine. > > maxThreads="150" SSLEnabled="true" scheme="https" > secure="true" >

Re: SSL issue in tomcat

2015-01-20 Thread Jason Y
Thank you all. Now it is working fine. By the way, do I need "ciphers" properties here? On Tue, Jan 20, 2015 at 11:22 PM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Jason, > > On 1/20/15 4:17 AM, Jason Y wrote: > > Recentl

Re: SSL issue in tomcat

2015-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jason, On 1/20/15 4:17 AM, Jason Y wrote: > Recently my application cannot be accessible in browser with https > version. I think it is due to vulnerability in ssl 3.0 issue. > > I checked my tomcat configuration and replaced sslProtocol="TLS" > wi

Re: SSL issue in tomcat

2015-01-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Rajesh, On 1/20/15 4:27 AM, Rajesh Biswas wrote: > Please keep SSLEnabled="true" along with your existing > configuration > > acceptCount="100" maxThreads="200" SSLEnabled="true" > scheme="https" secure="true" clientAuth="false" sslProtocols = >

Re: SSL issue in tomcat

2015-01-20 Thread Jason Y
Thanks, Raj, Sanaullah and Dave. I am not sure if it is POODLE issue( http://wiki.apache.org/tomcat/Security/POODLE), this solution is the same with Raj's suggestion. I will try, thanks. On Tue, Jan 20, 2015 at 5:43 PM, Utkarsh Dave wrote: > I don t think you will achieve what you want to via

Re: SSL issue in tomcat

2015-01-20 Thread Utkarsh Dave
I don t think you will achieve what you want to via disabling SSL protocol using sslEnabledProtocols. The vulnerability "I think it is due to vulnerability in ssl 3.0 issue." will not stop access to the application. You may want to revert your changes back, and check the firewall settings or anythi

Re: SSL issue in tomcat

2015-01-20 Thread Sanaullah
Please follow the Apache document for the connector configuration. Here is the sample connector configuration [1] http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html On Tue, Jan 20, 2015 at 2:17 PM, Jason Y wrote: > Hi folks, > > Recently my application cannot be accessible in browser wi

Re: SSL issue in tomcat

2015-01-20 Thread Rajesh Biswas
Hello, Please keep SSLEnabled="true" along with your existing configuration Rajesh On Tue, Jan 20, 2015 at 2:47 PM, Jason Y wrote: > Hi folks, > > Recently my application cannot be accessible in browser with https version. > I think it is due to vulnerability in ssl 3.0 issue. > > I checked

Re: SSL issue in tomcat

2015-01-20 Thread Jason Y
Hi folks, Recently my application cannot be accessible in browser with https version. I think it is due to vulnerability in ssl 3.0 issue. I checked my tomcat configuration and replaced sslProtocol="TLS" with sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" to disable SSL 3.0. con