Ssl – Configuring Tomcat 7 to use TLS only

ssltomcat7

I have a Tomcat 7 server on Ubuntu 14.04 (Java OpenJDK 1.7) which has been working fine for over a year, with no problems. A few months ago it stopped being accessible wtih Chrome, I dealt with that by switching to Firefox to access this particular site. Recently (a few days) ago it stopped being accessible with Firefox.

I have consulted this question which is basically the same problem as I'm having, but that solution no longer works for some reason. As of yesterday both Chrome 41 and Firefox 37 are not showing my site. On Chrome I get this response: 

A secure connection cannot be established because this site uses an unsupported protocol.
Error code: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

On Firefox I get this:

Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)

I have tried all the combinations of protocols that the answers and references recommend for Tomcat 7, but no dice. It appears that the browser makers have tightened down security enough that these parameters no longer work:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2"  />

I've been experimenting with different combinations of parameters all day and no luck. I've also been able to replicate the problem on two different Tomcat installations (the second on Windows), so I'm pretty sure it's not a machine problem.

Before I give up and install Java 8 and Tomcat 8, which will wipe out the rest of my weekend, I thought I'd ask about possible solutions here.

Best Answer

To debug the situation you can use the command line tools of openssl, especially openssl s_client. By adding the options -tls1, -tls1_1 and -tls1_2 you can test compatibility for the protocols, and with -cipher [cipherlist] for ciphers. For example

openssl s_client -connect example.com:443 -tls1

You will get detailed information and possibly warnings about the connection, the certificate and features (like Renegotiation, Compression, etc.). This will help to debug the issue.

Related Topic