You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@tomcat.apache.org by Suresh Kumar J <su...@gmail.com> on 2008/08/30 00:55:40 UTC

How to make to Apache-Tomcat 6.0.13 to support all of SSLv2/SSLv3 and TLS protocols

Hi!

Am running the Apache Tomcat (v6.0.13) on Redhat Linux. Below is the
snippet of the server.xml config:
----------------------------
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystoreType="PKCS12"
               keystoreFile="conf/my-key-store" keystorePass="abcd"/>
----------------------------

The https connection(TLS based) works fine with IE6.0/7.x and FireFox
2.0.x. But am having issues with the FireFox 3.0.1 on Windows XP with
the default settings. When I try to connect(https on 443) to Apache
Tomcat (v6.0.14), I get the following error on the FireFox 3.0.1 window:
-------------------------------------------
Secure Connection Failed
An error occurred during a connection to 10.xx.xx.xx
Cannot communicate securely with peer: no common encryption algorithm(s):
(Error code: ssl_error_no_cypher_overlap)
-------------------------------------------

Have observed the following error in the Catalina.out file:
--------------------------------------------------
Aug 29, 2008 2:52:52 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed
Throwable occurred: java.net.SocketException: SSL handshake error
javax.net.ssl.SSLException: INTERNAL ERROR
        at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESocketFactory.java:150)
        at
org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:310)
        at java.lang.Thread.run(Thread.java:657)
--------------------------------------------------

In the FireFox 3.0.1, both SSL3.0 and TLS1.0 are enabled(and SSLv2 is
disabled) in the browser security settings. The web-server is correctly
configured for secured http on TLS. Earlier with Firefox2.0.x, it was
working fine. Also checked with Linux version of FireFox3.0.1 and the
TLS connection is working fine.

When I tried to analysis the packets capture of the browser/web-server
communication via "WireShark/Ethereal" tools, I observed that the
FireFox3.0 on Windows uses "SSLv2 Record layer(Client Hello)" for SSL
handshake negotiations. As my Tomcat webserver is configured for TLS, it
doesn't seem to understand the SSLv2 record layer format, eventually
errors out with "javax.net.ssl.SSLException: INTERNAL ERROR.

Since SSLv2 is generally considered to be a weaker protocol than SSLv3
and TLS, am not sure why FireFox3.0.1 on Windows uses SSLv2 Record
protocol, also SSLv2 is disabled by default. On Redhat Linux, the same
FF3.0.1(firefox-3.0.1-1.el5) uses "TLSv1 Record Layer(Client Hello)" for
security negotiations. The FireFox v2.0.x on Windows uses "SSLv3 Record
Layer(Client Hello)" which seems to fine. Am able to launch the https
webpages on IE6.x and IE7.x and also FireFox2.0. The only issue is on
FireFox3.0 which uses "SSLv2 Record layer(Client Hello)" for SSL
handshake negotiations. Tomcat works well with TLS protocol, but when
the browser uses SSLv2 then it fails.

I tried changing the "sslProtocol" attribute in the "Connector" element
in conf/server.xml file and when the Tomcat couldn't start. Observed the
following error in catalina.out:
--------------------------------------
Aug 29, 2008 3:10:18 PM org.apache.coyote.http11.Http11Protocol init
SEVERE: Error initializing endpoint
Throwable occurred: java.io.IOException: SSLContext SSL implementation
not found
        at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:394)
        at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:125)
        at
org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:496)
        at
org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:177)
        at
org.apache.catalina.connector.Connector.initialize(Connector.java:1059)
        at
org.apache.catalina.core.StandardService.initialize(StandardService.java:677)
        at
org.apache.catalina.core.StandardServer.initialize(StandardServer.java:792)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:518)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
        at java.lang.reflect.VMReflection.invokeMethod(VMReflection.java)
        at java.lang.reflect.Method.invoke(Method.java:317)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:260)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:412)
--------------------------------------

Does Tomcat 6.0.x supports SSL implementation?. Is it possible to make
the Tomcat to understand both SSL and TLS protocols so that all the
browsers are supported. It seems to be critical to make the application
I use the certificate in the format of PKCS12, created via openssl tool.

Did anyone else face similar kind of problem in this regard.

Thanks,
Suresh



---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: How to make to Apache-Tomcat 6.0.13 to support all of SSLv2/SSLv3 and TLS protocols

Posted by Gregor Schneider <rc...@googlemail.com>.

On Wed, Sep 3, 2008 at 8:20 AM, Suresh Kumar J <su...@gmail.com> wrote:
> Am runing Harmony JRE in this case. Is this error related to Harmony JRE or
> Tomcat?.

Suresh, sorry, but unfortunately my cristal ball is not available...

Try it with the original SUN JDK - Not JRE and see if it works.

I have to apologize for the hint "ALL" since "all" (notice that it's
all small letters) only is available only in the https-connector when
using APR (Apache Portable Runtime).

However, maybe this piece from the docs gives you an idea:

============
The encryption/decryption protocol to be used on this socket. It is
not recommended to change this value if you are using Sun's JVM. It is
reported that IBM's 1.4.1 implementation of the TLS protocol is not
compatible with some popular browsers. In this case, use the value
SSL.
============

(http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html)

Seems some JDKs might have a problem with SSL.

Therefore, again, try SUN's original JDK.

Gregor
-- 
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org