You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Steffen Heil (Mailinglisten)" <li...@steffen-heil.de> on 2014/06/14 13:38:33 UTC
Choosing provider to load pkcs12 keystore for ssl
Hi
I am using tomcat with the NIO connector, so I load the ssl certificate and private key from a keystore in pkcs12 format.
This works fine using RSA.
Now I want to switch to a certificate using ECC and that EC is not supported by the JRE. It IS however supported by bouncycastle.
In my own code I need to specify "BC", when opening the keystore usng KeyStore.getInstance("PKCS12","BC").
Then I can load and use that certificate.
However there seems no way to do the same with the tomcat connector.
Is it possible?
How can I configure tomcat to use another provider?
Regards,
Steffen
Re: AW: Choosing provider to load pkcs12 keystore for ssl
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Steffen,
On 6/16/14, 12:01 PM, Steffen Heil (Mailinglisten) wrote:
> Okay, I must have overlooked the "keystoreProvider" attribute
> completely. Sorry for that and thanks a lot for the hint.
>
> However that only solved the loading part of the problem. The
> certificate is still unusable.
>
> When I try to connect, the browser reports an error. I set
> javax.net.debug=all and got the output below.
>
> I notice, that the server and the client cannot agree on the
> ciphersuite (fatal error: 40: no cipher suites in common) but I am
> lost on what I would need to configure. I did remove all settings
> of sslProtocol, sslProtocols and ciphers, as I think my old
> defaults will not match a ECC certificate, but still it does not
> work.
>
> Any further hint?
Try connecting with openssl s_client instead of a browser. Then you
can get more information on the client side. Are you sure your browser
supports ECC?
Also, Java (Oracle JRE v1.0.7) supports ECDH and ECDHE cipher suites
like these:
* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
* TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
I'm no expert on the JRE's support for crypto algorithms and
certificates, but the above seems to indicate that ECC is in fact
supported. Am I missing something?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJToFzgAAoJEBzwKT+lPKRYkRkQALuTcXQKrxgm+gLVNkBML8cI
A7ApPKTNP1xXu3MeqM9EDgeKScbAIi0PQzB/tNdfYMzu+/IznqtXAElND3hNBm7p
Guhy5hyApQzuCrY1jUSUT/+/rQ5E8KCnYFS6aBD9cbkI4D9HMk3BiWFpVhgPyYEt
dBEAm/Ftk+4dZzl/yns+HjnafIkHzRgxRkVxl/HGtaFnT45SGETMYRJv/Pz+p6sD
Xh19hgza43JEPzMW6Wp+zCkVMnmcciEoFjWNqQeADObSUDwc6mNsbOO6i6GLZxjH
AGr4BRvRUqP7WC06nO4zFUHtqffDBMej6PJH3lNc1rGD9PyoKtHsbfPnZ+Phcloe
DwX3XerojLt/SpRJqe4jNH0WSx2NBbdBoqm5/AImMMsInJjr+PXeLn5+x+C/9grd
dYwtJ/ytUfuybXtVHRnhnAZ6pG0KDSNG0QGvsNhmyu/s5o1GDiwC9tdm/n9ZFTI8
tUOMRwX7hAELYwBRx1/TNEB6FU7y8JXMiW1nQLKrjaA0R3RFMpq4Vrbbbuoev87f
jDi4ZULw7VudyCvlc9QOv7aSCaqEHxnkHtlFVBHmWFwrLnSiHY1qvdtIA2k4RDAn
1orA+1XdCLFOyVf78hEpUS/xhdZz2izY4wqxHjLw0aMxPhCspA/NrBwBuPWYhfMZ
c3KusK9QnZiA66xjYRVb
=8+su
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
AW: Choosing provider to load pkcs12 keystore for ssl
Posted by "Steffen Heil (Mailinglisten)" <li...@steffen-heil.de>.
Hi
Okay, I must have overlooked the "keystoreProvider" attribute completely.
Sorry for that and thanks a lot for the hint.
However that only solved the loading part of the problem.
The certificate is still unusable.
When I try to connect, the browser reports an error.
I set javax.net.debug=all and got the output below.
I notice, that the server and the client cannot agree on the ciphersuite (fatal error: 40: no cipher suites in common) but I am lost
on what I would need to configure.
I did remove all settings of sslProtocol, sslProtocols and ciphers, as I think my old defaults will not match a ECC certificate, but
still it does not work.
Any further hint?
Best regards,
Steffen
Using SSLEngineImpl.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
[Raw read]: length = 5
0000: 16 03 01 00 99 .....
[Raw read]: length = 153
0000: 01 00 00 95 03 03 34 CF F9 BC B4 23 4E F7 B2 EA ......4....#N...
0010: 0A F9 2B C1 24 8C 87 9F E6 C6 94 C8 BC 42 5E 68 ..+.$........B^h
0020: 35 5F B3 58 4C 59 00 00 2E C0 2B C0 2F C0 0A C0 5_.XLY....+./...
0030: 09 C0 13 C0 14 C0 12 C0 07 C0 11 00 33 00 32 00 ............3.2.
0040: 45 00 39 00 38 00 88 00 16 00 2F 00 41 00 35 00 E.9.8...../.A.5.
0050: 84 00 0A 00 05 00 04 01 00 00 3E FF 01 00 01 00 ..........>.....
0060: 00 0A 00 08 00 06 00 17 00 18 00 19 00 0B 00 02 ................
0070: 01 00 00 23 00 00 33 74 00 00 00 05 00 05 01 00 ...#..3t........
0080: 00 00 00 00 0D 00 12 00 10 04 01 05 01 02 01 04 ................
0090: 03 05 03 02 03 04 02 02 02 .........
osiris4-exec-1, READ: TLSv1 Handshake, length = 153
*** ClientHello, TLSv1.2
RandomCookie: GMT: 869202108 bytes = { 180, 35, 78, 247, 178, 234, 10, 249, 43, 193, 36, 140, 135, 159, 230, 198, 148, 200, 188, 66,
94, 104, 53, 95, 179, 88, 76, 89 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5]
Compression Methods: { 0 }
Extension renegotiation_info, renegotiated_connection: <empty>
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1}
Extension ec_point_formats, formats: [uncompressed]
Unsupported extension type_35, data:
Unsupported extension type_13172, data:
Unsupported extension status_request, data: 01:00:00:00:00
Extension signature_algorithms, signature_algorithms: SHA256withRSA, SHA384withRSA, SHA1withRSA, SHA256withECDSA, SHA384withECDSA,
SHA1withECDSA, Unknown (hash:0x4, signature:0x2), SHA1withDSA
***
[read] MD5 and SHA1 hashes: len = 153
0000: 01 00 00 95 03 03 34 CF F9 BC B4 23 4E F7 B2 EA ......4....#N...
0010: 0A F9 2B C1 24 8C 87 9F E6 C6 94 C8 BC 42 5E 68 ..+.$........B^h
0020: 35 5F B3 58 4C 59 00 00 2E C0 2B C0 2F C0 0A C0 5_.XLY....+./...
0030: 09 C0 13 C0 14 C0 12 C0 07 C0 11 00 33 00 32 00 ............3.2.
0040: 45 00 39 00 38 00 88 00 16 00 2F 00 41 00 35 00 E.9.8...../.A.5.
0050: 84 00 0A 00 05 00 04 01 00 00 3E FF 01 00 01 00 ..........>.....
0060: 00 0A 00 08 00 06 00 17 00 18 00 19 00 0B 00 02 ................
0070: 01 00 00 23 00 00 33 74 00 00 00 05 00 05 01 00 ...#..3t........
0080: 00 00 00 00 0D 00 12 00 10 04 01 05 01 02 01 04 ................
0090: 03 05 03 02 03 04 02 02 02 .........
%% Initialized: [Session-5, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-1, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-5, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-1, SEND TLSv1.2 ALERT: fatal, description = handshake_failure
osiris4-exec-1, WRITE: TLSv1.2 Alert, length = 2
osiris4-exec-1, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
osiris4-exec-1, called closeOutbound()
osiris4-exec-1, closeOutboundInternal()
Using SSLEngineImpl.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
[Raw read]: length = 5
0000: 16 03 01 00 7F .....
[Raw read]: length = 127
0000: 01 00 00 7B 03 02 A0 0B BB C4 B6 7E 09 24 09 FD .............$..
0010: 2D 42 43 81 06 8F 0D 16 26 98 F0 51 04 F8 2C 8C -BC.....&..Q..,.
0020: 3D D9 A0 9D 70 6A 00 00 2A C0 0A C0 09 C0 13 C0 =...pj..*.......
0030: 14 C0 12 C0 07 C0 11 00 33 00 32 00 45 00 39 00 ........3.2.E.9.
0040: 38 00 88 00 16 00 2F 00 41 00 35 00 84 00 0A 00 8...../.A.5.....
0050: 05 00 04 01 00 00 28 FF 01 00 01 00 00 0A 00 08 ......(.........
0060: 00 06 00 17 00 18 00 19 00 0B 00 02 01 00 00 23 ...............#
0070: 00 00 33 74 00 00 00 05 00 05 01 00 00 00 00 ..3t...........
osiris4-exec-2, READ: TLSv1 Handshake, length = 127
*** ClientHello, TLSv1.1
RandomCookie: GMT: -1609909564 bytes = { 182, 126, 9, 36, 9, 253, 45, 66, 67, 129, 6, 143, 13, 22, 38, 152, 240, 81, 4, 248, 44, 140,
61, 217, 160, 157, 112, 106 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5]
Compression Methods: { 0 }
Extension renegotiation_info, renegotiated_connection: <empty>
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1}
Extension ec_point_formats, formats: [uncompressed]
Unsupported extension type_35, data:
Unsupported extension type_13172, data:
Unsupported extension status_request, data: 01:00:00:00:00
***
[read] MD5 and SHA1 hashes: len = 127
0000: 01 00 00 7B 03 02 A0 0B BB C4 B6 7E 09 24 09 FD .............$..
0010: 2D 42 43 81 06 8F 0D 16 26 98 F0 51 04 F8 2C 8C -BC.....&..Q..,.
0020: 3D D9 A0 9D 70 6A 00 00 2A C0 0A C0 09 C0 13 C0 =...pj..*.......
0030: 14 C0 12 C0 07 C0 11 00 33 00 32 00 45 00 39 00 ........3.2.E.9.
0040: 38 00 88 00 16 00 2F 00 41 00 35 00 84 00 0A 00 8...../.A.5.....
0050: 05 00 04 01 00 00 28 FF 01 00 01 00 00 0A 00 08 ......(.........
0060: 00 06 00 17 00 18 00 19 00 0B 00 02 01 00 00 23 ...............#
0070: 00 00 33 74 00 00 00 05 00 05 01 00 00 00 00 ..3t...........
%% Initialized: [Session-6, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-2, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-6, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-2, SEND TLSv1.1 ALERT: fatal, description = handshake_failure
osiris4-exec-2, WRITE: TLSv1.1 Alert, length = 2
osiris4-exec-2, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
osiris4-exec-2, called closeOutbound()
osiris4-exec-2, closeOutboundInternal()
Using SSLEngineImpl.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
[Raw read]: length = 5
0000: 16 03 01 00 7F .....
[Raw read]: length = 127
0000: 01 00 00 7B 03 01 9D 89 95 9E D5 C3 C5 1A A6 8D ................
0010: 51 21 B7 66 1C 6F CE 21 FF 0F F6 80 C9 55 2A CF Q!.f.o.!.....U*.
0020: D3 DF 94 F7 36 78 00 00 2A C0 0A C0 09 C0 13 C0 ....6x..*.......
0030: 14 C0 12 C0 07 C0 11 00 33 00 32 00 45 00 39 00 ........3.2.E.9.
0040: 38 00 88 00 16 00 2F 00 41 00 35 00 84 00 0A 00 8...../.A.5.....
0050: 05 00 04 01 00 00 28 FF 01 00 01 00 00 0A 00 08 ......(.........
0060: 00 06 00 17 00 18 00 19 00 0B 00 02 01 00 00 23 ...............#
0070: 00 00 33 74 00 00 00 05 00 05 01 00 00 00 00 ..3t...........
osiris4-exec-3, READ: TLSv1 Handshake, length = 127
*** ClientHello, TLSv1
RandomCookie: GMT: -1668770658 bytes = { 213, 195, 197, 26, 166, 141, 81, 33, 183, 102, 28, 111, 206, 33, 255, 15, 246, 128, 201, 85,
42, 207, 211, 223, 148, 247, 54, 120 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5]
Compression Methods: { 0 }
Extension renegotiation_info, renegotiated_connection: <empty>
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1}
Extension ec_point_formats, formats: [uncompressed]
Unsupported extension type_35, data:
Unsupported extension type_13172, data:
Unsupported extension status_request, data: 01:00:00:00:00
***
[read] MD5 and SHA1 hashes: len = 127
0000: 01 00 00 7B 03 01 9D 89 95 9E D5 C3 C5 1A A6 8D ................
0010: 51 21 B7 66 1C 6F CE 21 FF 0F F6 80 C9 55 2A CF Q!.f.o.!.....U*.
0020: D3 DF 94 F7 36 78 00 00 2A C0 0A C0 09 C0 13 C0 ....6x..*.......
0030: 14 C0 12 C0 07 C0 11 00 33 00 32 00 45 00 39 00 ........3.2.E.9.
0040: 38 00 88 00 16 00 2F 00 41 00 35 00 84 00 0A 00 8...../.A.5.....
0050: 05 00 04 01 00 00 28 FF 01 00 01 00 00 0A 00 08 ......(.........
0060: 00 06 00 17 00 18 00 19 00 0B 00 02 01 00 00 23 ...............#
0070: 00 00 33 74 00 00 00 05 00 05 01 00 00 00 00 ..3t...........
%% Initialized: [Session-7, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-3, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-7, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-3, SEND TLSv1 ALERT: fatal, description = handshake_failure
osiris4-exec-3, WRITE: TLSv1 Alert, length = 2
osiris4-exec-3, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
osiris4-exec-3, called closeOutbound()
osiris4-exec-3, closeOutboundInternal()
Using SSLEngineImpl.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv2Hello
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for SSLv3
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
[Raw read]: length = 5
0000: 16 03 00 00 49 ....I
[Raw read]: length = 73
0000: 01 00 00 45 03 00 65 89 E7 A2 5A 4F FE C2 3B 12 ...E..e...ZO..;.
0010: 2D 1C C8 D8 5D 72 05 6B 4E 20 33 FB E1 06 FF F9 -...]r.kN 3.....
0020: E2 CB 93 A1 D1 D2 00 00 1E 00 FF 00 33 00 32 00 ............3.2.
0030: 45 00 39 00 38 00 88 00 16 00 2F 00 41 00 35 00 E.9.8...../.A.5.
0040: 84 00 0A 00 05 00 04 01 00 .........
osiris4-exec-4, READ: SSLv3 Handshake, length = 73
*** ClientHello, SSLv3
RandomCookie: GMT: 1686693538 bytes = { 90, 79, 254, 194, 59, 18, 45, 28, 200, 216, 93, 114, 5, 107, 78, 32, 51, 251, 225, 6, 255,
249, 226, 203, 147, 161, 209, 210 }
Session ID: {}
Cipher Suites: [TLS_EMPTY_RENEGOTIATION_INFO_SCSV, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5]
Compression Methods: { 0 }
***
[read] MD5 and SHA1 hashes: len = 73
0000: 01 00 00 45 03 00 65 89 E7 A2 5A 4F FE C2 3B 12 ...E..e...ZO..;.
0010: 2D 1C C8 D8 5D 72 05 6B 4E 20 33 FB E1 06 FF F9 -...]r.kN 3.....
0020: E2 CB 93 A1 D1 D2 00 00 1E 00 FF 00 33 00 32 00 ............3.2.
0030: 45 00 39 00 38 00 88 00 16 00 2F 00 41 00 35 00 E.9.8...../.A.5.
0040: 84 00 0A 00 05 00 04 01 00 .........
%% Initialized: [Session-8, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-4, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-8, SSL_NULL_WITH_NULL_NULL]
osiris4-exec-4, SEND SSLv3 ALERT: fatal, description = handshake_failure
osiris4-exec-4, WRITE: SSLv3 Alert, length = 2
osiris4-exec-4, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
osiris4-exec-4, called closeOutbound()
osiris4-exec-4, closeOutboundInternal()
Re: Choosing provider to load pkcs12 keystore for ssl
Posted by Konstantin Kolinko <kn...@gmail.com>.
2014-06-14 15:38 GMT+04:00 Steffen Heil (Mailinglisten) <li...@steffen-heil.de>:
> Hi
>
>
> I am using tomcat with the NIO connector, so I load the ssl certificate and private key from a keystore in pkcs12 format.
> This works fine using RSA.
>
> Now I want to switch to a certificate using ECC and that EC is not supported by the JRE. It IS however supported by bouncycastle.
> In my own code I need to specify "BC", when opening the keystore usng KeyStore.getInstance("PKCS12","BC").
> Then I can load and use that certificate.
>
> However there seems no way to do the same with the tomcat connector.
> Is it possible?
> How can I configure tomcat to use another provider?
The code in org.apache.tomcat.util.net.jsse.JSSESocketFactory#getStore(..) is
if (provider == null) {
ks = KeyStore.getInstance(type);
} else {
ks = KeyStore.getInstance(type, provider);
}
so you just have to set the provider = "BC".
That is AbstractEndpoint.setKeystoreProvider(String).
That is "keystoreProvider" attribute on a <Connector>.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org