Hi tomcaters,
I have a problem which evades me for a too long time. I am just unable to
find out what is wrong. I have a Tomcat 7.0.72 (version doesn't matter the
problem exists with 7.0.68 and 7.0.70 as well) with Oracle JDK 1.8.0_102
(the version doesn't matter much neither since the problem manifests with
1.8.0_92, 1.8.0_77 as well).
My Tomcat is unable to complete its TLSv1.2 handshaking protocol. I am
getting this in my log when enabling SSL debug:
-------------------
*** ClientHello, TLSv1.2RandomCookie: GMT: -1507805229 bytes = { 111,
107, 93, 180, 22, 176, 151, 182, 118, 207, 100, 218, 44, 244, 231,
167, 14, 64, 248, 62, 57, 126, 137, 35, 76, 84, 30, 245 }Session ID:
{}Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, Unknown 0xcc:0xa9, Unknown
0xcc:0xa8, Unknown 0xcc:0x14, Unknown 0xcc:0x13,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA,
SSL_RSA_WITH_3DES_EDE_CBC_SHA]Compression Methods: { 0 }Extension
renegotiation_info, renegotiated_connection: <empty>Extension
server_name, server_name: [type=host_name (0),
value=hostname.domainname.tld]Unsupported extension type_23,
data:Unsupported extension type_35, data:Extension
signature_algorithms, signature_algorithms: SHA512withRSA,
SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA,
SHA256withECDSA, SHA1withRSA, SHA1withECDSAUnsupported extension
status_request, data: 01:00:00:00:00Unsupported extension type_18,
data:Unsupported extension type_30032, data:Extension
ec_point_formats, formats: [uncompressed]Extension elliptic_curves,
curve names: {unknown curve 29,
java.security.spec.ECParameterSpec@2b839e7c,
java.security.spec.ECParameterSpec@55e0b1ed}***%% Initialized:
[Session-1, SSL_NULL_WITH_NULL_NULL]%% Negotiating: [Session-1,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]*** ServerHello, TLSv1.2
--------------------------
The key message seems to be: Extension elliptic_curves, curve names:
{unknown curve 29, java.security.spec.ECParameterSpec@2b839e7c,
java.security.spec.ECParameterSpec@55e0b1ed}
I should get something with a list of recognized curves. Later, when the
server will complete the handshaking with a fatal error, it will obviously
fail agreeing on the curve and share parameters. Like this:
-------------------------
****** ECDH ServerKeyExchangeSignature Algorithm SHA512withRSAServer
key: com.rsa.cryptoj.o.fn@a9c1e230*** ServerHelloDone
--------------------------
Where I should get the name of the curve and the parameters for the shared
secret.
Since I have some other instances on the same server running just fine. I
wonder what I should look for. What can lead to this failure?
Yes, I have the Unlimited JCE Policy installed and working for other
instances of Tomcat 8. Both Tomcat 8 and Tomcat 7 on this server share the
very same JDK.
In the Firefox browser, the message is as follow: Unsupported elliptic
curve. Error code: SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE
Which is the most descriptive message among the three following browsers:
IE 11, Chrome and Firefox. IE11 and Chrome are complaining about TLS
protocol error without saying anything about the cause of the error.
Any hints?
Regards,
-----------------
Daniel Savard
