You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "James H. H. Lampert" <ja...@touchtonecorp.com> on 2019/03/13 16:48:46 UTC
TLS protocols and cipher suites available under JSSE?
We've got a customer who is asking about cipher suites and TLS protocols.
Given Tomcat 7.0.93, with the option of running it under JDK 7.0, JDK
7.1, or JDK 8.0, can somebody point me to docs explaining what TLS
levels and cipher suites are available under the various JVMs?
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: TLS protocols and cipher suites available under JSSE?
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
James,
On 3/13/19 20:38, James H. H. Lampert wrote:
> Thanks, Mr. Schultz.
>
> I managed to find the IBM docs. At least some of the cipher suites
> the customer is talking about are supported all the way back to
> their 7.0 JVM.
>
> I've specified cipher suites by name in the connector, but I don't
> think I've done protocols. "TLS," according to the IBM docs,
> "Enables TLS v1.0 protocol (defined in RFC 2246). Accepts TLSv1
> hello encapsulated in an SSLv2 format hello."
>
> Sounds like I would need to enable TLSv1.1 and TLSv1.2 explicitly.
> Would I change the sslProtocol clause from
>> sslProtocol="TLS"
>
> to
>> sslProtocol="TLSv1.1,TLSv1.2"
> or even
>> sslProtocol="TLSv1.2"
>
> and specify acceptable cipher suites in the ciphers clause?
Specifying sslProtocol="TLS" is what you want, regardless of the
actual protocols you want to support. It's ... odd, but you have to
tell Java that you want "TLS" (generically) before you can tell it
what /kind/ of TLS you want. I believe that Java will never accept any
value other than "TLS" for that at this point. So you are left with
sslEnabledProtocols...
If you want to configure specific versions of TLS, this is where to do i
t:
sslEnabledProtocols="TLSv1.2, TLSv1.1, SSLv2Hello" (etc)
If you can tolerate it, I'd enable only TLSv1.2. Some clients still
require TLSv1. Virtually all clients supporting TLSv1.1 also support
TLSv1.2, so it's almost useless to enable TLSv1.1.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlyLsFgACgkQHPApP6U8
pFirkQ//TA0sE1AVpW7dr1/1+zkKZ/n9AIm6nKEnamcN6fF0rDchP+CW/uZMJjrF
TuKQUEyOZjS8M7qU7t6HR7xdwt7JbpPQhZ07PYLqhxw0uNYfZnqQfc1AWz+pMLxD
RNWPrtb9+A4uWI5B/c64rVJjD3Ig/dAZHH5xesspZrEwt12bTBVKdSa610pnN7Dr
DFY3PSpxeF+86a5/SJwZFEU1iu36+8krA7H99qA4XBYiwC4UPxIoSqtNznmZ08dH
kRrJ3EBSbDFB7/h/CqJUCnUyfJscal5ZYsALp/DKt1xpK7R3nGduRbgpsud5NcbD
bl9RNoEZ2aQBJClO+FLumWPnOX2pqLqIB9QxSdqxdC9kRUiSflcAc1XJXtWcHWty
PRXHEneG6AMe4uqJ7nzlxOBkCQlF7G3aShkbqPmmzV/IV0H3ncVt/4qW4fS+N5AR
iv41tva/9M8Y39uFyWyvp0U5s6sby3xXC9jlI3aqdIkofxvTG1G7cNGZeGMHDxsX
JY2e5k8/ZxKgaGifp6GWPNFt5fSiXpvVpJzQcBojwP4TP8D2cnxIyCZjPg0tUXiD
U4gnJqA0b5oexPFFCA1qZUTl0xgBCeZxqS8NcDh8Nu+hb4N0ZT8tL/UvApD8ZmfB
2E7A3K+ny462SI6mcvTHMKIR1SPSYTQ3MD+yYvqtw3XOBCIR9Zg=
=/zZH
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: TLS protocols and cipher suites available under JSSE?
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com>.
Thanks, Mr. Schultz.
I managed to find the IBM docs. At least some of the cipher suites the
customer is talking about are supported all the way back to their 7.0 JVM.
I've specified cipher suites by name in the connector, but I don't think
I've done protocols. "TLS," according to the IBM docs, "Enables TLS v1.0
protocol (defined in RFC 2246). Accepts TLSv1 hello encapsulated in an
SSLv2 format hello."
Sounds like I would need to enable TLSv1.1 and TLSv1.2 explicitly. Would
I change the sslProtocol clause from
> sslProtocol="TLS"
to
> sslProtocol="TLSv1.1,TLSv1.2"
or even
> sslProtocol="TLSv1.2"
and specify acceptable cipher suites in the ciphers clause?
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 under Java 11? Re: Has anybody ever heard of
"ECDHE-ECDSA-CHACHA20-POLY1305"?
Posted by Mark Thomas <ma...@apache.org>.
On 20/03/2019 10:05, Mark Thomas wrote:
> On 19/03/2019 23:49, James H. H. Lampert wrote:
>> In response to my question:
>>
>>>> I've just (same customer as before) been asked about
>>>> ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305
>>>>
>>>> and I can't find either one on the Sun or IBM JSSE cipher lists for
>>>> Java 8.
>>
>> On 3/19/19, 12:34 AM, Peter@Kreuser-Online wrote:
>>
>>> Most certainly only >=Java9... (OpenJDK and Oracle, don’t know about
>>> IBM though)
>>
>> Thanks.
>>
>> I've since learned that IBM Midrange systems will skip 9 and 10, but
>> will offer Java 11 at some point. But that begs the question of whether
>> or not Tomcat 7 (or our webapp context) will even run under Java 11.
>
> Tomcat 7 should run. If it doesn't, it would be treated as a bug and
> we'd fix it. We do test it from time to time.
This thread prompted me to grab the latest OpenJDKs and test them.
9.0.x and 8.5.x build and run with the latest Java 13 early access build
(EA12).
7.0.x won't build with Java 12 onwards because Tomcat 7 has a minimum
Java version of 6 and Java 11 was the last version of the compiler that
accepted Java 6 as an option. Once it is built, Tomcat 7.0.x runs quite
happily under Java 13 EA 12.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 under Java 11? Re: Has anybody ever heard of
"ECDHE-ECDSA-CHACHA20-POLY1305"?
Posted by Mark Thomas <ma...@apache.org>.
On 19/03/2019 23:49, James H. H. Lampert wrote:
> In response to my question:
>
>>> I've just (same customer as before) been asked about
>>> ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305
>>>
>>> and I can't find either one on the Sun or IBM JSSE cipher lists for
>>> Java 8.
>
> On 3/19/19, 12:34 AM, Peter@Kreuser-Online wrote:
>
>> Most certainly only >=Java9... (OpenJDK and Oracle, don’t know about
>> IBM though)
>
> Thanks.
>
> I've since learned that IBM Midrange systems will skip 9 and 10, but
> will offer Java 11 at some point. But that begs the question of whether
> or not Tomcat 7 (or our webapp context) will even run under Java 11.
Tomcat 7 should run. If it doesn't, it would be treated as a bug and
we'd fix it. We do test it from time to time.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Tomcat 7 under Java 11? Re: Has anybody ever heard of "ECDHE-ECDSA-CHACHA20-POLY1305"?
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com>.
In response to my question:
>> I've just (same customer as before) been asked about
>> ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305
>>
>> and I can't find either one on the Sun or IBM JSSE cipher lists for
>> Java 8.
On 3/19/19, 12:34 AM, Peter@Kreuser-Online wrote:
> Most certainly only >=Java9... (OpenJDK and Oracle, don’t know about
> IBM though)
Thanks.
I've since learned that IBM Midrange systems will skip 9 and 10, but
will offer Java 11 at some point. But that begs the question of whether
or not Tomcat 7 (or our webapp context) will even run under Java 11.
--
James H. H. Lampert
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Has anybody ever heard of "ECDHE-ECDSA-CHACHA20-POLY1305"? was
Re: TLS protocols and cipher suites
Posted by "Peter@Kreuser-Online" <lo...@kreuser.name>.
Hi James,
> Am 18.03.2019 um 23:49 schrieb James H. H. Lampert <ja...@touchtonecorp.com>:
>
> I've just (same customer as before) been asked about
> ECDHE-ECDSA-CHACHA20-POLY1305
> and ECDHE-RSA-CHACHA20-POLY1305
>
> and I can't find either one on the Sun or IBM JSSE cipher lists for Java 8.
>
Most certainly only >=Java9... (OpenJDK and Oracle, don’t know about IBM though)
> --
> JHHL
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Has anybody ever heard of "ECDHE-ECDSA-CHACHA20-POLY1305"? was
Re: TLS protocols and cipher suites
Posted by "Peter@Kreuser-Online" <lo...@kreuser.name>.
Oh,
and yes I’ve heard about them and used the RSA version!
Peter
> Am 18.03.2019 um 23:49 schrieb James H. H. Lampert <ja...@touchtonecorp.com>:
>
> I've just (same customer as before) been asked about
> ECDHE-ECDSA-CHACHA20-POLY1305
> and ECDHE-RSA-CHACHA20-POLY1305
>
> and I can't find either one on the Sun or IBM JSSE cipher lists for Java 8.
>
> --
> JHHL
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Has anybody ever heard of "ECDHE-ECDSA-CHACHA20-POLY1305"? was Re:
TLS protocols and cipher suites
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com>.
I've just (same customer as before) been asked about
ECDHE-ECDSA-CHACHA20-POLY1305
and ECDHE-RSA-CHACHA20-POLY1305
and I can't find either one on the Sun or IBM JSSE cipher lists for Java 8.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: TLS protocols and cipher suites available under JSSE?
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com>.
On 3/13/19, 2:53 PM, Christopher Schultz wrote:
> 7: https://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html
>
> 8: https://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html
>
> If you are using a non-standard "provider" (like one from IBM!), then
> you'll have to read their documentation to find out what they provide.
Dear Mr. Schultz:
I was able to do a bit of trial-and-error this afternoon.
I found that on an AS/400 running Tomcat 7.0.47 under Java 7, with IBM
JSSE (see
<https://www.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.security.component.70.doc/security-component/jsse2Docs/protocols.html>
for reference)
If I specified
> sslProtocol="TLSv1.1,TLSv1.2"
then connector initialization blew up.
If I specified
> sslProtocol="TLSv1.2"
then connector initialization didn't blow up, but neither did I get TLSv1.2.
If I specified
> sslEnabledProtocols="TLSv1.1,TLSv1.2" sslProtocol="TLSv1.1,TLSv1.2"
it blew up again. Apparently it doesn't like a comma-separated list for
sslProtocol. This is what showed up in catalina.out:
> SEVERE: Failed to initialize end point associated with ProtocolHandler ["http-bio-12.151.5.120-443"]
> java.io.IOException: TLSv1.1,TLSv1.2 SSLContext not available
> at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:459)
> at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:192)
> at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:397)
> at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:623)
> at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:434)
> at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
> . . .
> Caused by: java.security.NoSuchAlgorithmException: TLSv1.1,TLSv1.2 SSLContext not available
> at sun.security.jca.GetInstance.getInstance(GetInstance.java:172)
> at javax.net.ssl.SSLContext.getInstance(SSLContext.java:26)
> at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSSLContext(JSSESocketFactory.java:472)
> at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:433)
. . .
But if I do
> sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" sslProtocol="SSL_TLSv2"
(with "SSL_TLSv2" being an IBM special value for "anything that's
enabled, up to and including TLSv1.2), then it works, and indicates a
TLSv1.2 connection, from a reasonably current version of Chrome, and
also works from a very old Firefox that doesn't go past TLSv1.0.
And if I tweak the "sslEnabledProtocols," value, I can get it to reject
1.0, or reject 1.2, in predictable ways.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: TLS protocols and cipher suites available under JSSE?
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
James,
On 3/13/19 12:48 PM, James H. H. Lampert wrote:
> We've got a customer who is asking about cipher suites and TLS
> protocols.
>
> Given Tomcat 7.0.93, with the option of running it under JDK 7.0,
> JDK 7.1, or JDK 8.0, can somebody point me to docs explaining what
> TLS levels and cipher suites are available under the various JVMs?
You should look at the docs for each version of Java:
7:
https://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProvi
ders.html
8:
https://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProvi
ders.html
If you are using a non-standard "provider" (like one from IBM!), then
you'll have to read their documentation to find out what they provide.
If you are using OpenSSL, then the list of supported cipher suites
will be tied to the version of OpenSSL that you are using.
I would always run with the latest JDK you can tolerate. We are
running Tomcat 8.5.x on OpenJDK 8 in production, but we are running
OpenJDK 11 in dev/test and everything seems just fine. I don't see any
reason why Tomcat 7.0.x wouldn't run on a modern JVM, and you'll get
much better support for newer cipher suites.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlyJe8sACgkQHPApP6U8
pFj9Pw//R2bXzuXx25L60kyzXKhOJLZroERD83EEtooadS0jIOfvs3h5G4GGuLGF
MSsLEN5+DMEzAcb6+uFGcukfWLkSYkf5QL2MWJMGhm9jXQcY3TNzuURrcKhB34vg
O6Gx416FPdXEBsLT7Cc20bLBlq1SvPUXMMWNJ1YGfNpi5+zDbmgcX8JsTivAx1Aw
pC0b4rOAF0qfrYFhskW1alpuRlHQgRVPcFcA1MCcytO1FewCpe7gHqWeWKWOW3/Z
jtCi9ChsbX6fEE6M1sD47Xqgrq2FN8eM09BXe0ZCV1dvG1H0QlJ1NkMaykbRC9DE
quqPn8a7afDPjdNMO009Dx+gO/hj3I09e3rlnnq1ePu6pIRkG7Z1zR7TIuQ0A+SO
utJMaTSUnbjxiU4euDo/O294dzTeJb3kfD2Z4KnR+kMAUjoJuY8K2/jtGBTGf63q
o6Y6FfuwYs799c1zeYlRcaFABHV5SpgRYeVEPyVdRchv3np0WnXty6eELu0GWvYx
PvTPbXNl7Il9h+4MWvK5meMy4PeLvfawgS5dAlGXrQANwBVnatbSSGrWd/h3JvvX
nGQAMsWtDbOYx5P5u9c+MkkAcoLUdJq1PGNh2tVbbEVWYQBQnl57DfOHmAqOInq5
SAaa6oIg0CeKz9ymNECmwmXWFT9kM3xkLZP0xQYsUTKiSMWdQ/0=
=lODH
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org