Re: Cannot disable SSL v3

2014-10-20 Thread Ognjen Blagojevic
Deepak, On 17.10.2014 19:13, dku...@ccilindia.co.in wrote: How can I know which protocol support my JVM. We are using java1.7.0_40 Take a look at: https://wiki.apache.org/tomcat/Security/POODLE Please let us know is any turnaround in my server.xml configuration to disable SSL v3. Pleas

Re: Cannot disable SSL v3

2014-10-17 Thread dkumar
Dear Chris Thanks for your reply How can I know which protocol support my JVM. We are using java1.7.0_40 I have tested with https://www.ssllabs.com/ssltest/index.html Please let us know is any turnaround in my server.xml configuration to disable SSL v3. Thanks and Regards Deepak -BE

Re: Cannot disable SSL v3

2014-10-17 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Deepak, On 10/17/14 11:58 AM, dku...@ccilindia.co.in wrote: > Below is my configuration in server.xml file of tomcat 7.0.22. Upgrade. > ="org.apache.catalina.connector.http.HttpConnector" No such class exists. Which connector are you actually us

Cannot disable SSL v3

2014-10-17 Thread dkumar
Dear All, Below is my configuration in server.xml file of tomcat 7.0.22. I tried with below changes. 1. sslProtocol changed to SSLProtocol 2. Removed SSL_RSA_WITH_3DES_EDE_CBC_SHA cipher from ciphers 3. sslProtocol ="TLS" ch

Re: cannot disable SSL v3 [SOLVED]

2014-10-17 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Deepak, On 10/17/14 12:21 AM, dku...@ccilindia.co.in wrote: > I have removed SSL [cipher] from my configuration. and its working. > Please let me know is this correct way to solve this. > > I am running Tomcat 7.0.22 scheme="https" secure="true"

Re: cannot disable SSL v3 [SOLVED]

2014-10-16 Thread dkumar
Hello all, I have removed SSL cypher from my configuration. and its working. Please let me know is this correct way to solve this. I am running Tomcat 7.0.22 I believe some village somewhere was missing somebody :) > > Reading the tomcat/apr doc > (http://tomcat.

Re: cannot disable SSL v3 [SOLVED]

2014-10-16 Thread David kerber
On 10/16/2014 2:38 PM, Vu Pham wrote: I believe some village somewhere was missing somebody :) Reading the tomcat/apr doc (http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support) , I found that I have to use SSLProtocol instead of sslProtocol. Tomcat's case-sensitivity has bitten

Re: cannot disable SSL v3 [SOLVED]

2014-10-16 Thread Vu Pham
I believe some village somewhere was missing somebody :) Reading the tomcat/apr doc (http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support) , I found that I have to use SSLProtocol instead of sslProtocol. After making that change, SSLv3 disappear. Thanks, Vu On 10/16/2014 08:

cannot disable SSL v3

2014-10-16 Thread vu pham
All, I am running tomcat 7.0.26 with APR on RHEL 5.10 (x86_64) . My server.xml 's configuration for the https connector is as follows: I also tried sslProtocol with different values of TLS, TLSv1.1, and TLSv1.2, but the ssl tests such the ones from SSLLabs or Thawte claim that my server