there is also a bug fixed for the support of TLS1.1 and TLS1.2 by Marcel
Šebek. may be that need to apply
https://issues.apache.org/bugzilla/show_bug.cgi?id=53952#c1
On Sun, Jan 5, 2014 at 8:18 AM, Sanaullah <sanaulla...@gmail.com> wrote:
> you can create the ECC self singed certificates using the below two
> commands of Openssl
>
> openssl ecparam -out sinful.key -name prime256v1 -genkey
> openssl req -x509 -new -key sinful.key -out sinful-ca.pem -outform PEM
> -days 3650
>
> root@ubuntu:/# openssl s_client -connect localhost:8443
> CONNECTED(00000003)
> Server certificate
> -----BEGIN CERTIFICATE-----
> MIIB5zCCAY6gAwIBAgIJAIgQsiTjPbouMAkGByqGSM49BAEwUTELMAkGA1UEBhMC
> TVgxEzARBgNVBAgMClNvbWUtU3RhdGUxDDAKBgNVBAoMA3VuaTEOMAwGA1UECwwF
> YWRtaW4xDzANBgNVBAMMBnVidW50dTAeFw0xNDAxMDUwMjE0NDZaFw0yNDAxMDMw
> MjE0NDZaMFExCzAJBgNVBAYTAk1YMRMwEQYDVQQIDApTb21lLVN0YXRlMQwwCgYD
> VQQKDAN1bmkxDjAMBgNVBAsMBWFkbWluMQ8wDQYDVQQDDAZ1YnVudHUwWTATBgcq
> hkjOPQIBBggqhkjOPQMBBwNCAAQMy2uSVwbPg1wPOXrqsnvE7YZZ46k1HzMGlpJg
> +aPFJOKAbYuMYG6f5PY634Qn6qWBuyeorj8epZBlY1f573Kko1AwTjAdBgNVHQ4E
> FgQU6k2A1GIkIUw+BkDRJLV+664BKQYwHwYDVR0jBBgwFoAU6k2A1GIkIUw+BkDR
> JLV+664BKQYwDAYDVR0TBAUwAwEB/zAJBgcqhkjOPQQBA0gAMEUCIQCYpIAwCJ+p
> X/C2F6Cqa3xU6dpfuFnwqHL4PfQX4Yv+TQIgewShairhIVKvpWicOnuChYY72RjZ
> EmVg3uQq9XxPfiI=
> -----END CERTIFICATE-----
>
> ---
> SSL handshake has read 836 bytes and written 453 bytes
> ---
> New, TLSv1/SSLv3, Cipher is ECDH-ECDSA-AES256-SHA
> Server public key is 256 bit
> Secure Renegotiation IS supported
>
> Compression: NONE
> Expansion: NONE
> SSL-Session:
> Protocol : TLSv1
> Cipher : ECDH-ECDSA-AES256-SHA
> Session-ID:
> 0BC1B06C5FF21C1AF5E303269E3FF71D4ADBD65F2D9C89E82E1C7EF5A285EC12
> Session-ID-ctx:
> Master-Key:
> 7C86159B8A5003E2812D464FD59BD1ED05B87FE68123BAE0B3F5C7C773ACD76133F109E3525560DCFF9687C6DFB764D1
>
> Key-Arg : None
> PSK identity: None
> PSK identity hint: None
> SRP username: None
> TLS session ticket lifetime hint: 7200 (seconds)
> TLS session ticket:
> 0000 - 39 18 5f 31 c0 e2 a0 1e-78 b8 66 7d 47 7b 1c de
> 9._1....x.f}G{..
> 0010 - 84 88 b3 25 b3 15 0c ca-d1 37 73 be 50 b8 8e 3e
> ...%.....7s.P..>
> 0020 - e5 51 62 04 8f 84 c6 b5-a9 6d aa 36 97 85 e9 05
> .Qb......m.6....
> 0030 - 71 5e d5 83 c3 88 fb 34-c2 98 5b b4 18 09 89 1f
> q^.....4..[.....
> 0040 - 5c 3f 6d cf 16 a5 3b 7f-dc 36 0d 3f fa 8d 55 b4
> \?m...;..6.?..U.
> 0050 - 48 37 73 8f 75 22 88 da-28 e7 16 06 7c b2 ad 36
> H7s.u"..(...|..6
> 0060 - 44 16 de e3 12 31 33 6e-51 19 4f 5e b7 d9 08 ab
> D....13nQ.O^....
> 0070 - 90 ce 7b eb 69 e4 8a 77-ca 3a de 6a ec f9 30 7c
> ..{.i..w.:.j..0|
> 0080 - eb a0 e6 3f 8c 16 61 c4-2d 58 4b 9b fc 14 b5 84
> ...?..a.-XK.....
> 0090 - 49 4c 22 6d 56 a5 55 e4-16 27 7a 3f a4 d8 96 91
> IL"mV.U..'z?....
> 00a0 - a1 b6 bd 9c ef e9 fd 4e-77 e4 b2 22 13 d0 95 68
> .......Nw.."...h
>
> Start Time: 1388891510
> Timeout : 300 (sec)
> Verify return code: 18 (self signed certificate)
> ---
>
>
> I am also unable to initialize any TLS1.1 or TLS1.2 related ECC Ciphers
>
> Here is my config
> tomcat 7.0.47
> libapr 1.5.0-1
> tcnative 1.1.29-1
>
> <Connector port="8443"
> SSLEnabled="true"
> maxThreads="150" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLS"
> SSLProtocol="all"
> SSLCertificateFile="/home/san/sinful.pem"
> SSLCertificateKeyFile="/home/san/sinful.key" />
>
>
>
>
> On Sun, Jan 5, 2014 at 6:02 AM, Christopher Schultz <
> ch...@christopherschultz.net> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA256
>>
>> Mark,
>>
>> On 1/4/14, 6:37 PM, Mark Eggers wrote:
>> > On 1/4/2014 1:18 PM, Christopher Schultz wrote:
>> >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
>> >>
>> >> Musassir,
>> >>
>> >> On 1/4/14, 4:08 PM, Christopher Schultz wrote:
>> >>> Musassir,
>> >>>
>> >>> On 1/3/14, 5:27 PM, Mudassir Aftab wrote:
>> >>>> Again, we have to submit this as a bug.....TLS 1.2 is not
>> >>>> working in Tomcat
>> >>>
>> >>> Tomcat 7.0.74 Oracle Java 1.7.0_45 tcnative 1.1.29 trunk
>> >>> (essentially 1.2.29
>> >>>
>> >>> tcnative$ make clean tcnative$ ./configure --with-apr=`which
>> >>> apr-config` --with-java-home=/usr/local/java-7 --with-ssl
>> >>> tcnative$ time make [...] make[1]: Leaving directory
>> >>> `/home/cschultz/projects/tomcat-native-1.1.x/native'
>> >>>
>> >>> real 0m14.790s user 0m15.300s sys 0m1.840s
>> >>>
>> >>> tcnative$ cp -d .libs/* $CATALINA_HOME/bin
>> >>>
>> >>> tcnative$ cd $CATALINA_BASE
>> >>>
>> >>> tomcat$ cat conf/server.xml
>> >>>
>> >>> [...] <Connector port="8218"
>> >>> protocol="org.apache.coyote.http11.Http11AprProtocol"
>> >>> SSLEnabled="true" secure="true" scheme="https"
>> >>> SSLCertificateKeyFile="[...]" SSLCertificateFile="[...]"
>> >>> SSLCertificateChainFile="[...]" SSLProtocol="all"
>> >>> executor="tomcatThreadPool" URIEncoding="UTF-8" /> [...]
>> >>>
>> >>> tomcat$ bin/startup.sh
>> >>>
>> >>> [...] Jan 04, 2014 3:17:26 PM
>> >>> org.apache.catalina.core.AprLifecycleListener init INFO: Loaded
>> >>> APR based Apache Tomcat Native library 1.1.30 using APR version
>> >>> 1.4.6. Jan 04, 2014 3:17:26 PM
>> >>> org.apache.catalina.core.AprLifecycleListener init INFO: APR
>> >>> capabilities: IPv6 [true], sendfile [true], accept filters
>> >>> [false], random [true]. Jan 04, 2014 3:17:26 PM
>> >>> org.apache.catalina.core.AprLifecycleListener initializeSSL
>> >>> INFO: OpenSSL successfully initialized (OpenSSL 1.0.1e 11 Feb
>> >>> 2013) [...]
>> >>>
>> >>> tomcat$ openssl s_client -connect myhost:8218 [...] verify
>> >>> error:num=19:self signed certificate in certificate chain
>> >>> [...] SSL-Session: Protocol : TLSv1.2 Cipher :
>> >>> DHE-RSA-AES256-GCM-SHA384 [...]
>> >>>
>> >>> *disconnect*
>> >>>
>> >>> I can confirm that Mozilla Firefox 26 on Mac OS X 10.9 can
>> >>> connect using TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA cipher.
>> >>>
>> >>> Looks like TLS1.2 works just fine in the default configuration
>> >>> (SSLProtocol="all" is the default).
>> >>>
>> >>> Let's try your configuration. I'm only going to change
>> >>> SSLProtocol from "all" to "TLSv1":
>> >>>
>> >>> <Connector port="8218"
>> >>> protocol="org.apache.coyote.http11.Http11AprProtocol"
>> >>> SSLEnabled="true" secure="true" scheme="https"
>> >>> SSLCertificateKeyFile="[...]" SSLCertificateFile="[...]"
>> >>> SSLCertificateChainFile="[...]" SSLProtocol="TLSv1"
>> >>> executor="tomcatThreadPool" URIEncoding="UTF-8" />
>> >>>
>> >>> * Restart Tomcat*
>> >>>
>> >>> tomcat$ openssl s_client -connect myhost:8218 [...]
>> >>> SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA
>> >>> [...]
>> >>>
>> >>> Trying again with Firefox 26 give me
>> >>> cipher=TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA.
>> >>>
>> >>> Let's try restricting to only your cipher. Let's make sure that
>> >>> my OpenSSL version supports it, first:
>> >>>
>> >>> tomcat$ openssl ciphers -v | grep ECDHE-ECDSA-AES128-SHA256
>> >>> ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA
>> >>> Enc=AES(128) Mac=SHA256
>> >>>
>> >>>
>> >>> Yup. Let's configure it in Tomcat:
>> >>>
>> >>> <Connector port="8218"
>> >>> protocol="org.apache.coyote.http11.Http11AprProtocol"
>> >>> SSLEnabled="true" secure="true" scheme="https"
>> >>> SSLCipherSuite="ECDHE-ECDSA-AES128-SHA256"
>> >>> SSLCertificateKeyFile="[...]" SSLCertificateFile="[...]"
>> >>> SSLCertificateChainFile="[...]" SSLProtocol="TLSv1"
>> >>> executor="tomcatThreadPool" URIEncoding="UTF-8" />
>> >>>
>> >>>
>> >>> $ openssl s_client -connect myhost:8218 CONNECTED(00000003)
>> >>> 139718306563752:error:14077410:SSL
>> >>> routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake
>> >>> failure:s23_clnt.c:741:
>> >>>
>> >>> $ openssl s_client -tls1 -connect myhost:8218
>> >>> CONNECTED(00000003) 139965071759016:error:14094410:SSL
>> >>> routines:SSL3_READ_BYTES:sslv3 alert handshake
>> >>> failure:s3_pkt.c:1256:SSL alert number 40
>> >>> 139965071759016:error:1409E0E5:SSL
>> >>> routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:
>> >>>
>> >>> $ openssl s_client -tls1_1 -connect myhost:8218
>> >>> CONNECTED(00000003) 140680041133736:error:1408F10B:SSL
>> >>> routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:
>> >>>
>> >>> $ openssl s_client -tls1_2 -connect myhost:8218
>> >>> CONNECTED(00000003) 139976873068200:error:1408F10B:SSL
>> >>> routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:
>> >>>
>> >>> Firefox also fails with "ssl_error_no_cypher_overlap".
>> >>>
>> >>> $ $ sslscan myhost:8218 _ ___ ___| |___ ___ __ _ _ __ / __/
>> >>> __| / __|/ __/ _` | '_ \ \__ \__ \ \__ \ (_| (_| | | | |
>> >>> |___/___/_|___/\___\__,_|_| |_|
>> >>>
>> >>> Version 1.8.2 http://www.titania.co.uk Copyright Ian
>> >>> Ventura-Whiting 2009
>> >>>
>> >>> Testing SSL server myhost on port 8218
>> >>>
>> >>> Supported Server Cipher(s): Failed SSLv3 256 bits
>> >>> ECDHE-RSA-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> ECDHE-ECDSA-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> ECDHE-RSA-AES256-SHA384 Failed SSLv3 256 bits
>> >>> ECDHE-ECDSA-AES256-SHA384 Rejected SSLv3 256 bits
>> >>> ECDHE-RSA-AES256-SHA Rejected SSLv3 256 bits
>> >>> ECDHE-ECDSA-AES256-SHA Rejected SSLv3 256 bits
>> >>> SRP-DSS-AES-256-CBC-SHA Rejected SSLv3 256 bits
>> >>> SRP-RSA-AES-256-CBC-SHA Failed SSLv3 256 bits
>> >>> DHE-DSS-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> DHE-RSA-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> DHE-RSA-AES256-SHA256 Failed SSLv3 256 bits
>> >>> DHE-DSS-AES256-SHA256 Rejected SSLv3 256 bits
>> >>> DHE-RSA-AES256-SHA Rejected SSLv3 256 bits
>> >>> DHE-DSS-AES256-SHA Rejected SSLv3 256 bits
>> >>> DHE-RSA-CAMELLIA256-SHA Rejected SSLv3 256 bits
>> >>> DHE-DSS-CAMELLIA256-SHA Rejected SSLv3 256 bits
>> >>> AECDH-AES256-SHA Rejected SSLv3 256 bits
>> >>> SRP-AES-256-CBC-SHA Failed SSLv3 256 bits
>> >>> ADH-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> ADH-AES256-SHA256 Rejected SSLv3 256 bits ADH-AES256-SHA
>> >>> Rejected SSLv3 256 bits ADH-CAMELLIA256-SHA Failed SSLv3
>> >>> 256 bits ECDH-RSA-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> ECDH-ECDSA-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >>> ECDH-RSA-AES256-SHA384 Failed SSLv3 256 bits
>> >>> ECDH-ECDSA-AES256-SHA384 Rejected SSLv3 256 bits
>> >>> ECDH-RSA-AES256-SHA Rejected SSLv3 256 bits
>> >>> ECDH-ECDSA-AES256-SHA Failed SSLv3 256 bits
>> >>> AES256-GCM-SHA384 Failed SSLv3 256 bits AES256-SHA256
>> >>> Rejected SSLv3 256 bits AES256-SHA Rejected SSLv3 256 bits
>> >>> CAMELLIA256-SHA Failed SSLv3 256 bits PSK-AES256-CBC-SHA
>> >>> Rejected SSLv3 168 bits ECDHE-RSA-DES-CBC3-SHA Rejected
>> >>> SSLv3 168 bits ECDHE-ECDSA-DES-CBC3-SHA Rejected SSLv3 168
>> >>> bits SRP-DSS-3DES-EDE-CBC-SHA Rejected SSLv3 168 bits
>> >>> SRP-RSA-3DES-EDE-CBC-SHA Rejected SSLv3 168 bits
>> >>> EDH-RSA-DES-CBC3-SHA Rejected SSLv3 168 bits
>> >>> EDH-DSS-DES-CBC3-SHA Rejected SSLv3 168 bits
>> >>> AECDH-DES-CBC3-SHA Rejected SSLv3 168 bits
>> >>> SRP-3DES-EDE-CBC-SHA Rejected SSLv3 168 bits ADH-DES-CBC3-SHA
>> >>> Rejected SSLv3 168 bits ECDH-RSA-DES-CBC3-SHA Rejected SSLv3
>> >>> 168 bits ECDH-ECDSA-DES-CBC3-SHA Rejected SSLv3 168 bits
>> >>> DES-CBC3-SHA Failed SSLv3 168 bits PSK-3DES-EDE-CBC-SHA
>> >>> Failed SSLv3 128 bits ECDHE-RSA-AES128-GCM-SHA256 Failed
>> >>> SSLv3 128 bits ECDHE-ECDSA-AES128-GCM-SHA256 Failed SSLv3
>> >>> 128 bits ECDHE-RSA-AES128-SHA256 Failed SSLv3 128 bits
>> >>> ECDHE-ECDSA-AES128-SHA256 Rejected SSLv3 128 bits
>> >>> ECDHE-RSA-AES128-SHA Rejected SSLv3 128 bits
>> >>> ECDHE-ECDSA-AES128-SHA Rejected SSLv3 128 bits
>> >>> SRP-DSS-AES-128-CBC-SHA Rejected SSLv3 128 bits
>> >>> SRP-RSA-AES-128-CBC-SHA Failed SSLv3 128 bits
>> >>> DHE-DSS-AES128-GCM-SHA256 Failed SSLv3 128 bits
>> >>> DHE-RSA-AES128-GCM-SHA256 Failed SSLv3 128 bits
>> >>> DHE-RSA-AES128-SHA256 Failed SSLv3 128 bits
>> >>> DHE-DSS-AES128-SHA256 Rejected SSLv3 128 bits
>> >>> DHE-RSA-AES128-SHA Rejected SSLv3 128 bits
>> >>> DHE-DSS-AES128-SHA Rejected SSLv3 128 bits DHE-RSA-SEED-SHA
>> >>> Rejected SSLv3 128 bits DHE-DSS-SEED-SHA Rejected SSLv3
>> >>> 128 bits DHE-RSA-CAMELLIA128-SHA Rejected SSLv3 128 bits
>> >>> DHE-DSS-CAMELLIA128-SHA Rejected SSLv3 128 bits
>> >>> AECDH-AES128-SHA Rejected SSLv3 128 bits
>> >>> SRP-AES-128-CBC-SHA Failed SSLv3 128 bits
>> >>> ADH-AES128-GCM-SHA256 Failed SSLv3 128 bits
>> >>> ADH-AES128-SHA256 Rejected SSLv3 128 bits ADH-AES128-SHA
>> >>> Rejected SSLv3 128 bits ADH-SEED-SHA Rejected SSLv3 128
>> >>> bits ADH-CAMELLIA128-SHA Failed SSLv3 128 bits
>> >>> ECDH-RSA-AES128-GCM-SHA256 Failed SSLv3 128 bits
>> >>> ECDH-ECDSA-AES128-GCM-SHA256 Failed SSLv3 128 bits
>> >>> ECDH-RSA-AES128-SHA256 Failed SSLv3 128 bits
>> >>> ECDH-ECDSA-AES128-SHA256 Rejected SSLv3 128 bits
>> >>> ECDH-RSA-AES128-SHA Rejected SSLv3 128 bits
>> >>> ECDH-ECDSA-AES128-SHA Failed SSLv3 128 bits
>> >>> AES128-GCM-SHA256 Failed SSLv3 128 bits AES128-SHA256
>> >>> Rejected SSLv3 128 bits AES128-SHA Rejected SSLv3 128 bits
>> >>> SEED-SHA Rejected SSLv3 128 bits CAMELLIA128-SHA Failed
>> >>> SSLv3 128 bits PSK-AES128-CBC-SHA Rejected SSLv3 128 bits
>> >>> ECDHE-RSA-RC4-SHA Rejected SSLv3 128 bits
>> >>> ECDHE-ECDSA-RC4-SHA Rejected SSLv3 128 bits AECDH-RC4-SHA
>> >>> Rejected SSLv3 128 bits ADH-RC4-MD5 Rejected SSLv3 128 bits
>> >>> ECDH-RSA-RC4-SHA Rejected SSLv3 128 bits ECDH-ECDSA-RC4-SHA
>> >>> Rejected SSLv3 128 bits RC4-SHA Rejected SSLv3 128 bits
>> >>> RC4-MD5 Failed SSLv3 128 bits PSK-RC4-SHA Rejected SSLv3
>> >>> 56 bits EDH-RSA-DES-CBC-SHA Rejected SSLv3 56 bits
>> >>> EDH-DSS-DES-CBC-SHA Rejected SSLv3 56 bits ADH-DES-CBC-SHA
>> >>> Rejected SSLv3 56 bits DES-CBC-SHA Rejected SSLv3 40 bits
>> >>> EXP-EDH-RSA-DES-CBC-SHA Rejected SSLv3 40 bits
>> >>> EXP-EDH-DSS-DES-CBC-SHA Rejected SSLv3 40 bits
>> >>> EXP-ADH-DES-CBC-SHA Rejected SSLv3 40 bits EXP-DES-CBC-SHA
>> >>> Rejected SSLv3 40 bits EXP-RC2-CBC-MD5 Rejected SSLv3 40
>> >>> bits EXP-ADH-RC4-MD5 Rejected SSLv3 40 bits EXP-RC4-MD5
>> >>> Rejected SSLv3 0 bits ECDHE-RSA-NULL-SHA Rejected SSLv3 0
>> >>> bits ECDHE-ECDSA-NULL-SHA Rejected SSLv3 0 bits
>> >>> AECDH-NULL-SHA Rejected SSLv3 0 bits ECDH-RSA-NULL-SHA
>> >>> Rejected SSLv3 0 bits ECDH-ECDSA-NULL-SHA Failed SSLv3
>> >>> 0 bits NULL-SHA256 Rejected SSLv3 0 bits NULL-SHA
>> >>> Rejected SSLv3 0 bits NULL-MD5 Failed TLSv1 256 bits
>> >>> ECDHE-RSA-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> ECDHE-ECDSA-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> ECDHE-RSA-AES256-SHA384 Failed TLSv1 256 bits
>> >>> ECDHE-ECDSA-AES256-SHA384 Rejected TLSv1 256 bits
>> >>> ECDHE-RSA-AES256-SHA Rejected TLSv1 256 bits
>> >>> ECDHE-ECDSA-AES256-SHA Rejected TLSv1 256 bits
>> >>> SRP-DSS-AES-256-CBC-SHA Rejected TLSv1 256 bits
>> >>> SRP-RSA-AES-256-CBC-SHA Failed TLSv1 256 bits
>> >>> DHE-DSS-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> DHE-RSA-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> DHE-RSA-AES256-SHA256 Failed TLSv1 256 bits
>> >>> DHE-DSS-AES256-SHA256 Rejected TLSv1 256 bits
>> >>> DHE-RSA-AES256-SHA Rejected TLSv1 256 bits
>> >>> DHE-DSS-AES256-SHA Rejected TLSv1 256 bits
>> >>> DHE-RSA-CAMELLIA256-SHA Rejected TLSv1 256 bits
>> >>> DHE-DSS-CAMELLIA256-SHA Rejected TLSv1 256 bits
>> >>> AECDH-AES256-SHA Rejected TLSv1 256 bits
>> >>> SRP-AES-256-CBC-SHA Failed TLSv1 256 bits
>> >>> ADH-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> ADH-AES256-SHA256 Rejected TLSv1 256 bits ADH-AES256-SHA
>> >>> Rejected TLSv1 256 bits ADH-CAMELLIA256-SHA Failed TLSv1
>> >>> 256 bits ECDH-RSA-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> ECDH-ECDSA-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >>> ECDH-RSA-AES256-SHA384 Failed TLSv1 256 bits
>> >>> ECDH-ECDSA-AES256-SHA384 Rejected TLSv1 256 bits
>> >>> ECDH-RSA-AES256-SHA Rejected TLSv1 256 bits
>> >>> ECDH-ECDSA-AES256-SHA Failed TLSv1 256 bits
>> >>> AES256-GCM-SHA384 Failed TLSv1 256 bits AES256-SHA256
>> >>> Rejected TLSv1 256 bits AES256-SHA Rejected TLSv1 256 bits
>> >>> CAMELLIA256-SHA Failed TLSv1 256 bits PSK-AES256-CBC-SHA
>> >>> Rejected TLSv1 168 bits ECDHE-RSA-DES-CBC3-SHA Rejected
>> >>> TLSv1 168 bits ECDHE-ECDSA-DES-CBC3-SHA Rejected TLSv1 168
>> >>> bits SRP-DSS-3DES-EDE-CBC-SHA Rejected TLSv1 168 bits
>> >>> SRP-RSA-3DES-EDE-CBC-SHA Rejected TLSv1 168 bits
>> >>> EDH-RSA-DES-CBC3-SHA Rejected TLSv1 168 bits
>> >>> EDH-DSS-DES-CBC3-SHA Rejected TLSv1 168 bits
>> >>> AECDH-DES-CBC3-SHA Rejected TLSv1 168 bits
>> >>> SRP-3DES-EDE-CBC-SHA Rejected TLSv1 168 bits ADH-DES-CBC3-SHA
>> >>> Rejected TLSv1 168 bits ECDH-RSA-DES-CBC3-SHA Rejected TLSv1
>> >>> 168 bits ECDH-ECDSA-DES-CBC3-SHA Rejected TLSv1 168 bits
>> >>> DES-CBC3-SHA Failed TLSv1 168 bits PSK-3DES-EDE-CBC-SHA
>> >>> Failed TLSv1 128 bits ECDHE-RSA-AES128-GCM-SHA256 Failed
>> >>> TLSv1 128 bits ECDHE-ECDSA-AES128-GCM-SHA256 Failed TLSv1
>> >>> 128 bits ECDHE-RSA-AES128-SHA256 Failed TLSv1 128 bits
>> >>> ECDHE-ECDSA-AES128-SHA256 Rejected TLSv1 128 bits
>> >>> ECDHE-RSA-AES128-SHA Rejected TLSv1 128 bits
>> >>> ECDHE-ECDSA-AES128-SHA Rejected TLSv1 128 bits
>> >>> SRP-DSS-AES-128-CBC-SHA Rejected TLSv1 128 bits
>> >>> SRP-RSA-AES-128-CBC-SHA Failed TLSv1 128 bits
>> >>> DHE-DSS-AES128-GCM-SHA256 Failed TLSv1 128 bits
>> >>> DHE-RSA-AES128-GCM-SHA256 Failed TLSv1 128 bits
>> >>> DHE-RSA-AES128-SHA256 Failed TLSv1 128 bits
>> >>> DHE-DSS-AES128-SHA256 Rejected TLSv1 128 bits
>> >>> DHE-RSA-AES128-SHA Rejected TLSv1 128 bits
>> >>> DHE-DSS-AES128-SHA Rejected TLSv1 128 bits DHE-RSA-SEED-SHA
>> >>> Rejected TLSv1 128 bits DHE-DSS-SEED-SHA Rejected TLSv1
>> >>> 128 bits DHE-RSA-CAMELLIA128-SHA Rejected TLSv1 128 bits
>> >>> DHE-DSS-CAMELLIA128-SHA Rejected TLSv1 128 bits
>> >>> AECDH-AES128-SHA Rejected TLSv1 128 bits
>> >>> SRP-AES-128-CBC-SHA Failed TLSv1 128 bits
>> >>> ADH-AES128-GCM-SHA256 Failed TLSv1 128 bits
>> >>> ADH-AES128-SHA256 Rejected TLSv1 128 bits ADH-AES128-SHA
>> >>> Rejected TLSv1 128 bits ADH-SEED-SHA Rejected TLSv1 128
>> >>> bits ADH-CAMELLIA128-SHA Failed TLSv1 128 bits
>> >>> ECDH-RSA-AES128-GCM-SHA256 Failed TLSv1 128 bits
>> >>> ECDH-ECDSA-AES128-GCM-SHA256 Failed TLSv1 128 bits
>> >>> ECDH-RSA-AES128-SHA256 Failed TLSv1 128 bits
>> >>> ECDH-ECDSA-AES128-SHA256 Rejected TLSv1 128 bits
>> >>> ECDH-RSA-AES128-SHA Rejected TLSv1 128 bits
>> >>> ECDH-ECDSA-AES128-SHA Failed TLSv1 128 bits
>> >>> AES128-GCM-SHA256 Failed TLSv1 128 bits AES128-SHA256
>> >>> Rejected TLSv1 128 bits AES128-SHA Rejected TLSv1 128 bits
>> >>> SEED-SHA Rejected TLSv1 128 bits CAMELLIA128-SHA Failed
>> >>> TLSv1 128 bits PSK-AES128-CBC-SHA Rejected TLSv1 128 bits
>> >>> ECDHE-RSA-RC4-SHA Rejected TLSv1 128 bits
>> >>> ECDHE-ECDSA-RC4-SHA Rejected TLSv1 128 bits AECDH-RC4-SHA
>> >>> Rejected TLSv1 128 bits ADH-RC4-MD5 Rejected TLSv1 128 bits
>> >>> ECDH-RSA-RC4-SHA Rejected TLSv1 128 bits ECDH-ECDSA-RC4-SHA
>> >>> Rejected TLSv1 128 bits RC4-SHA Rejected TLSv1 128 bits
>> >>> RC4-MD5 Failed TLSv1 128 bits PSK-RC4-SHA Rejected TLSv1
>> >>> 56 bits EDH-RSA-DES-CBC-SHA Rejected TLSv1 56 bits
>> >>> EDH-DSS-DES-CBC-SHA Rejected TLSv1 56 bits ADH-DES-CBC-SHA
>> >>> Rejected TLSv1 56 bits DES-CBC-SHA Rejected TLSv1 40 bits
>> >>> EXP-EDH-RSA-DES-CBC-SHA Rejected TLSv1 40 bits
>> >>> EXP-EDH-DSS-DES-CBC-SHA Rejected TLSv1 40 bits
>> >>> EXP-ADH-DES-CBC-SHA Rejected TLSv1 40 bits EXP-DES-CBC-SHA
>> >>> Rejected TLSv1 40 bits EXP-RC2-CBC-MD5 Rejected TLSv1 40
>> >>> bits EXP-ADH-RC4-MD5 Rejected TLSv1 40 bits EXP-RC4-MD5
>> >>> Rejected TLSv1 0 bits ECDHE-RSA-NULL-SHA Rejected TLSv1 0
>> >>> bits ECDHE-ECDSA-NULL-SHA Rejected TLSv1 0 bits
>> >>> AECDH-NULL-SHA Rejected TLSv1 0 bits ECDH-RSA-NULL-SHA
>> >>> Rejected TLSv1 0 bits ECDH-ECDSA-NULL-SHA Failed TLSv1
>> >>> 0 bits NULL-SHA256 Rejected TLSv1 0 bits NULL-SHA
>> >>> Rejected TLSv1 0 bits NULL-MD5
>> >>>
>> >>> The cipher appears to be supported by both client (OpenSSL
>> >>> s_client) and server (Also using the same version of OpenSSL)
>> >>> but the handshake cannot complete.
>> >>>
>> >>> Let's try another cipher. How about one that worked before:
>> >>> DHE-RSA-AES256-SHA
>> >>>
>> >>>
>> >>> <Connector port="8218"
>> >>> protocol="org.apache.coyote.http11.Http11AprProtocol"
>> >>> SSLEnabled="true" secure="true" scheme="https"
>> >>> SSLCipherSuite="DHE-RSA-AES256-SHA"
>> >>> SSLCertificateKeyFile="[...]" SSLCertificateFile="[...]"
>> >>> SSLCertificateChainFile="[...]" SSLProtocol="TLSv1"
>> >>> executor="tomcatThreadPool" URIEncoding="UTF-8" />
>> >>>
>> >>> $ openssl c_client -connect myhost:8218 [...] SSL-Session:
>> >>> Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA [...]
>> >>>
>> >>> Works. Firefox 26 also works.
>> >>>
>> >>> There must be some kind of problem with configuring
>> >>> ECDHE-ECDSA-AES128-SHA256 specifically. Try another cipher?
>> >>
>> >> Oh, I also tried this:
>> >>
>> >> <Connector port="8218"
>> >> protocol="org.apache.coyote.http11.Http11AprProtocol"
>> >> SSLEnabled="true" secure="true" scheme="https"
>> >> SSLCertificateKeyFile="[...]" SSLCertificateFile="[...]"
>> >> SSLCertificateChainFile="[...]" SSLProtocol="TLSv1"
>> >> executor="tomcatThreadPool" URIEncoding="UTF-8" />
>> >>
>> >> $ openssl s_client -connect myhost:8218 -cipher
>> >> ECDHE-ECDSA-AES128-SHA256 CONNECTED(00000003)
>> >> 140418231797416:error:14077410:SSL
>> >> routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake
>> >> failure:s23_clnt.c:741:
>> >>
>> >> (Try some other cipher) $ openssl s_client -connect myhost:8218
>> >> -cipher DHE-RSA-AES256-SHA
>> >>
>> >> [...] SSL-Session: Protocol : TLSv1 Cipher :
>> >> DHE-RSA-AES256-SHA [...]
>> >>
>> >> $ sslscan myhost:8218 | grep ECDHE-ECDSA Failed SSLv3 256
>> >> bits ECDHE-ECDSA-AES256-GCM-SHA384 Failed SSLv3 256 bits
>> >> ECDHE-ECDSA-AES256-SHA384 Rejected SSLv3 256 bits
>> >> ECDHE-ECDSA-AES256-SHA Rejected SSLv3 168 bits
>> >> ECDHE-ECDSA-DES-CBC3-SHA Failed SSLv3 128 bits
>> >> ECDHE-ECDSA-AES128-GCM-SHA256 Failed SSLv3 128 bits
>> >> ECDHE-ECDSA-AES128-SHA256 Rejected SSLv3 128 bits
>> >> ECDHE-ECDSA-AES128-SHA Rejected SSLv3 128 bits
>> >> ECDHE-ECDSA-RC4-SHA Rejected SSLv3 0 bits
>> >> ECDHE-ECDSA-NULL-SHA Failed TLSv1 256 bits
>> >> ECDHE-ECDSA-AES256-GCM-SHA384 Failed TLSv1 256 bits
>> >> ECDHE-ECDSA-AES256-SHA384 Rejected TLSv1 256 bits
>> >> ECDHE-ECDSA-AES256-SHA Rejected TLSv1 168 bits
>> >> ECDHE-ECDSA-DES-CBC3-SHA Failed TLSv1 128 bits
>> >> ECDHE-ECDSA-AES128-GCM-SHA256 Failed TLSv1 128 bits
>> >> ECDHE-ECDSA-AES128-SHA256 Rejected TLSv1 128 bits
>> >> ECDHE-ECDSA-AES128-SHA Rejected TLSv1 128 bits
>> >> ECDHE-ECDSA-RC4-SHA Rejected TLSv1 0 bits
>> >> ECDHE-ECDSA-NULL-SHA
>> >>
>> >> It looks like there is something wrong with the ECDHE-ECDSA
>> >> suites. If anything, this is an OpenSSL problem and not a Tomcat
>> >> one: Tomcat doesn't do anything with the crypto, here.
>> >>
>> >> - -chris
>> >
>> > Did you make an ECDSA cert?
>> >
>> > . . . . still in RFP response mode, so only 1/2 cent here
>>
>> ECDHE is Elliptic curve Diffie–Hellman Exchange, which is just DHE
>> with elliptic curve. Note that I was able to use other (non-EC) DHE
>> ciphers.
>>
>> AFAIK, the only choice you have when creating an SSL/TLS certificate
>> is whether to create an RSA or DSA key. The problem is more likely
>> that the "ECDSA" part of the algorithm won't work without a DSA key.
>>
>> Thanks for pointing that out.
>>
>> On the other hand, it appears that no ECDHE ciphers are working:
>>
>> $ sslscan myhost:8218 | grep ECDHE
>> Failed SSLv3 256 bits ECDHE-RSA-AES256-GCM-SHA384
>> Failed SSLv3 256 bits ECDHE-ECDSA-AES256-GCM-SHA384
>> Failed SSLv3 256 bits ECDHE-RSA-AES256-SHA384
>> Failed SSLv3 256 bits ECDHE-ECDSA-AES256-SHA384
>> Rejected SSLv3 256 bits ECDHE-RSA-AES256-SHA
>> Rejected SSLv3 256 bits ECDHE-ECDSA-AES256-SHA
>> Rejected SSLv3 168 bits ECDHE-RSA-DES-CBC3-SHA
>> Rejected SSLv3 168 bits ECDHE-ECDSA-DES-CBC3-SHA
>> Failed SSLv3 128 bits ECDHE-RSA-AES128-GCM-SHA256
>> Failed SSLv3 128 bits ECDHE-ECDSA-AES128-GCM-SHA256
>> Failed SSLv3 128 bits ECDHE-RSA-AES128-SHA256
>> Failed SSLv3 128 bits ECDHE-ECDSA-AES128-SHA256
>> Rejected SSLv3 128 bits ECDHE-RSA-AES128-SHA
>> Rejected SSLv3 128 bits ECDHE-ECDSA-AES128-SHA
>> Rejected SSLv3 128 bits ECDHE-RSA-RC4-SHA
>> Rejected SSLv3 128 bits ECDHE-ECDSA-RC4-SHA
>> Rejected SSLv3 0 bits ECDHE-RSA-NULL-SHA
>> Rejected SSLv3 0 bits ECDHE-ECDSA-NULL-SHA
>> Failed TLSv1 256 bits ECDHE-RSA-AES256-GCM-SHA384
>> Failed TLSv1 256 bits ECDHE-ECDSA-AES256-GCM-SHA384
>> Failed TLSv1 256 bits ECDHE-RSA-AES256-SHA384
>> Failed TLSv1 256 bits ECDHE-ECDSA-AES256-SHA384
>> Rejected TLSv1 256 bits ECDHE-RSA-AES256-SHA
>> Rejected TLSv1 256 bits ECDHE-ECDSA-AES256-SHA
>> Rejected TLSv1 168 bits ECDHE-RSA-DES-CBC3-SHA
>> Rejected TLSv1 168 bits ECDHE-ECDSA-DES-CBC3-SHA
>> Failed TLSv1 128 bits ECDHE-RSA-AES128-GCM-SHA256
>> Failed TLSv1 128 bits ECDHE-ECDSA-AES128-GCM-SHA256
>> Failed TLSv1 128 bits ECDHE-RSA-AES128-SHA256
>> Failed TLSv1 128 bits ECDHE-ECDSA-AES128-SHA256
>> Rejected TLSv1 128 bits ECDHE-RSA-AES128-SHA
>> Rejected TLSv1 128 bits ECDHE-ECDSA-AES128-SHA
>> Rejected TLSv1 128 bits ECDHE-RSA-RC4-SHA
>> Rejected TLSv1 128 bits ECDHE-ECDSA-RC4-SHA
>> Rejected TLSv1 0 bits ECDHE-RSA-NULL-SHA
>> Rejected TLSv1 0 bits ECDHE-ECDSA-NULL-SHA
>>
>> OpenSSL does have a few new tricks since the EC stuff was added, though:
>>
>> $ openssl --help
>> [...]
>> dhparam
>> ecparam
>> ec
>> gendh
>> genpkey
>> pkeyparam
>> [...]
>>
>> It looks like these algorithms probably *do* require a different
>> flavor of key, and not just a standard RSA key like most folks are
>> used to (and even if the algorithm contains "RSA" and not "DSA", among
>> other things).
>>
>> - -chris
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1
>> Comment: GPGTools - http://gpgtools.org
>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>> iQIcBAEBCAAGBQJSyK8XAAoJEBzwKT+lPKRYcTIP/3fxN7Ctf+ROs2hbvXgmQT5P
>> xE2VIFXP8wIAhiSogDmMKipx5T7zR06JzwutB/5a/0rZ2n+nMy5bVmkgA9K1ZiDH
>> n4Ccfr8zpanTSt51GhXg5rLwg2LAB3KrnL2Dyb8sI0g2QEmoh0XgFTbGwcBeuin3
>> 2ZAXC/y5QhKoUBk7Iv66AoQ7YTV8kJJpwIjBY4Mhbd9sZTRh7YWKtAwbXEkuveqz
>> 5M3rv/H4aDS4FE6zgZ2fgUy4qAnoyr+1wjC1vWIdPe7BEe4tlDoI/tx95H7ggjvr
>> Gy5FomHSoHvV2EkjzWJdiD/g5HW43AjpkpCLwLjlDnufLFgZtRbrVXMX8QxHjL2G
>> V5F6cb/+ZUXGoUgyBiFsG1QkJELcKP7BLBu2ew3BBiW8ybrFPulIQet97EZ0nE4/
>> aTJxx7AnjMjuHlYHGu3q2xz983SViulYtJ1iShbpYESePQfnA77aEqmP9nytD6Dg
>> gqgudz7ecy1x5nGkYj8VT4/6Tkc6t8kGIQGWoQbJoEt4cQWfQVOZP+lFKtXkGwxL
>> 7b0ykx6b+x/pvEHPttYTMzRbYMnQ5mInhT6266jPPQThcLOXwjn16PD9UQkslFp9
>> nxbpoj5o7S86qfB/XONL+E9WgWfpWmgkLKMQ06pYeZLo0L47RERg20eSLhNYRUTu
>> VRRJySduvE3hWnCj5IZp
>> =Jak9
>> -----END PGP SIGNATURE-----
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>
>>
>
