RE: [EXTERNAL] Re: Can Tomcat 9 be FIPS compliant without OpenSSL?

2020-12-03 Thread George Stanchev
You can add this to your guide and perhaps a little explanation: Add this to your JAVA_OPTS: -Dorg.bouncycastle.rsa.allow_multi_use=true Otherwise you're doomed to run into weird random and failures depending on what cipher suite your browser and server agree on which believe me, combined with

RE: [EXTERNAL] Re: Can Tomcat 9 be FIPS compliant without OpenSSL?

2020-12-03 Thread George Stanchev
You can add this to your guide and perhaps a little explanation: Add this to your JAVA_OPTS: -Dorg.bouncycastle.rsa.allow_multi_use=true Otherwise you're doomed to run into weird random and failures depending on what cipher suite your browser and server agree on which believe me, combined with

RE: [EXTERNAL] Re: Can Tomcat 9 be FIPS compliant without OpenSSL?

2020-12-03 Thread George Stanchev
Java's FIPS mode is "expirmental" feature that was removed in later Java versions. It was never certified (AFAIK). To me the only two viable options are via APR+OpenSSL 1.0.1/FIPS and BCFIPS. We have implemented the later and have ran into issues with RSA keys. First the C# BCPROV doesn't suppor

RE: Bouncy Castle FIPS on RHEL 7.3

2020-12-03 Thread George Stanchev
Hi Amit, Consider changing "securerandom.strongAlgorithms" to "NativePRNGNonBlocking:SUN" in your Java's "lib\security\java.security". The default is "NativePRNGBlocking:SUN" and is really enthropy thirsty on startup as it runs it's self tests and seeds its PRNG George -Original Message-

Re: embedded tomcat and context.xml

2020-12-03 Thread Rob Sargent
Again, much appreciated feedback.  (I never think what I'm doing is all that special) Though two concurrent users would really be "wildly successful", each of those users will fire up hundreds (thousands if we get permission/capacity) of EC2 instances and start pounding the db, so I think con

Re: embedded tomcat and context.xml

2020-12-03 Thread Christopher Schultz
Rob, On 12/3/20 11:03, Rob Sargent wrote: Thanks for you time. Your response goes a long way to explaining why there is so little specific information on embedding tomcat. Only programmers are interested in using embedded Tomcat, so having "Tomcat Embedded For Dummies" isn't terribly useful. (I

[SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up

2020-12-03 Thread Mark Thomas
CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M9 Apache Tomcat 9.0.0.M5 to 9.0.39 Apache Tomcat 8.5.1 to 8.5.59 Description: While investigating Bug 64830 it was discovered

Re: embedded tomcat and context.xml

2020-12-03 Thread Rob Sargent
Chris, Thanks for you time. Your response goes a long way to explaining why there is so little specific information on embedding tomcat. Really, just as I said. I had convinced myself from several items encountered on the web that an embedded tomcat instance would not read the standard conf/*.x

Re: embedded tomcat and context.xml

2020-12-03 Thread Christopher Schultz
Rob, On 12/2/20 13:31, Rob Sargent wrote: I'm old and easily confused: does an embedded tomcat server read (any) context.xml file?  I find conflicting answers /out there./ Using tomcat 9.0.40    embeddedTomcat =new Tomcat();    embeddedTomcat.setPort(tomcatPort);    embeddedTomcat.enableNa

Re: ERR_CONNECTION_REFUSED

2020-12-03 Thread Christopher Schultz
Tercio, On 11/30/20 10:38, Tercio Pedro wrote: I am a user of the Tomcat server, I need assistance in configuring the ssl certificate and port 443. I installed the ssl certificate but the site just opens on port 8443 I want to go to port 443, I already changed the port on the connector (server.

Re: Fetching connector from jmx by name

2020-12-03 Thread Christopher Schultz
Fred, On 11/30/20 04:07, Fred Al wrote: Is it possible to put an identifier on a connector and use that identifier to retrieve the connector by identifier from JMX? No. You will need to use the connector's "computed" name. You could also enumerate all connectors and choose by some other crite