You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2013/09/09 00:08:46 UTC
[Bug 55537] New: add support for TLS1.1 and TLS1.2 excluding TLS1.0
(BEAST attack)
https://issues.apache.org/bugzilla/show_bug.cgi?id=55537
Bug ID: 55537
Summary: add support for TLS1.1 and TLS1.2 excluding TLS1.0
(BEAST attack)
Product: Tomcat 7
Version: unspecified
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: hauser@acm.org
see also Bug 53952 for native.
In http://tomcat.apache.org/tomcat-6.0-doc/config/http.html#SSL%20Support, the
"sslProtocol" attribute would have to be String[], i.e. e.g. comma separated
protocol list
currently, TLSv1.2 can be put there, but it doesn't appear to have a limiting
effect on TLSv1.0
http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SSLContext
https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 55537] add support for TLS1.1 and TLS1.2 excluding TLS1.0
(BEAST attack)
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55537
--- Comment #2 from Ralf Hauser <ha...@acm.org> ---
Cool, this makes
https://www.ssllabs.com/ssltest/analyze.html?d=mysite.tld
happy except for the renegotiation (bug 55536)
but firefox cannot connect anymore...
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 55537] add support for TLS1.1 and TLS1.2 excluding TLS1.0
(BEAST attack)
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55537
Ognjen Blagojevic <og...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--- Comment #1 from Ognjen Blagojevic <og...@gmail.com> ---
(In reply to Ralf Hauser from comment #0)
> In http://tomcat.apache.org/tomcat-6.0-doc/config/http.html#SSL%20Support,
> the "sslProtocol" attribute would have to be String[], i.e. e.g. comma
> separated protocol list
You created bug for Tomcat 7, but you are quoting Tomcat 6 docs.
HTTPS connector in Tomcat 7 has attribute sslEnabledProtocols by which you may
specify only desired protocols, e.g. TLS 1.1 and TLS 1.2.
The same attribute in Tomcat 6 is called "protocols", but it is undocumented.
Take a look at the bug 54691.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 55537] add support for TLS1.1 and TLS1.2 excluding TLS1.0
(BEAST attack)
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55537
Ognjen Blagojevic <og...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org