WARNING – None of the Ciphers Specified Are Supported by the SSL Engine

ssltlstomcattomcat7

I have a working web service running through Apache Tomcat 7 with the following connector element in server.xml:

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" 
 SSLEnabled="true" 
 maxThreads="150"
 scheme="https" 
 secure="true" 
 clientAuth="false"  
 keystoreFile="C:\Java\myhost.keystore" 
 keystorePass="importkey" 
 sslProtocol="TLS"
/>

This has been working fine for years, but now a new Logjam security threat emerged, and I am trying to secure my web service, using the Guide to Deploying Diffie-Hellman for TLS instructions.

So, I added the following line to the <connector> element:

ciphers="ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-GCM-SHA256,
ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-GCM-SHA384,
DHE-RSA-AES128-GCM-SHA256,
DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA,
ECDHE-ECDSA-AES256-SHA, DHE-RSA-AES128-SHA256, DHE-RSA-AES128-SHA,
DHE-DSS-AES128-SHA256, DHE-RSA-AES256-SHA256, DHE-DSS-AES256-SHA,
DHE-RSA-AES256-SHA, AES128-GCM-SHA256, AES256-GCM-SHA384,
AES128-SHA256, AES256-SHA256, AES128-SHA, AES256-SHA, AES, CAMELLIA,
DES-CBC3-SHA"

Tomcat restarts fine, but I am no longer able to connect to my web service.

Upon examining the log, I noticed this line:

WARNING: None of the ciphers specified are supported by the SSL engine
: ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-GCM-SHA256,
ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-GCM-SHA384,
DHE-RSA-AES128-GCM-SHA256,
DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA,
ECDHE-ECDSA-AES256-SHA, DHE-RSA-AES128-SHA256, DHE-RSA-AES128-SHA,
DHE-DSS-AES128-SHA256, DHE-RSA-AES256-SHA256, DHE-DSS-AES256-SHA,
DHE-RSA-AES256-SHA, AES128-GCM-SHA256, AES256-GCM-SHA384,
AES128-SHA256, AES256-SHA256, AES128-SHA, AES256-SHA, AES, CAMELLIA,
DES-CBC3-SHA

What am I missing in trying to get Tomcat use only these ciphers?

How do I make them supported by the SSL engine?

Best Answer

As explained here you may have to set the ciphers list like this :

sslProtocols = "TLS"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_25‌​6_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"

The first part, ECDHE, specifies what key exchange algorithm should be used. [...]

Next up is the authentication algorithm, RSA. [...]

The bulk cipher, AES128-GCM is the main encryption algorithm and used to encrypt all the traffic. [...]

The last part, SHA256, identifies the message digest in use, which verifies the authenticity of messages.

Related Topic