Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread John Blaut
Hi Following the recent announcement of the SSLv3 POODLE vulnerability (CVE-2014-3566), when disabling SSLv3 on Tomcat APR/Native using the following configuration: SSLProtocol="TLSv1", it seems that the effect is that besides the SSLv3 protocol even the TLSv1.1 and TLSv1.2 protocols no longer re

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread Giles Coochey
On 15/10/2014 13:42, John Blaut wrote: Hi Following the recent announcement of the SSLv3 POODLE vulnerability (CVE-2014-3566), when disabling SSLv3 on Tomcat APR/Native using the following configuration: SSLProtocol="TLSv1", it seems that the effect is that besides the SSLv3 protocol even the TL

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread James Drews
That isn't working for tomcat 6, it will only accept TLSv1 for the SSLProtocol entry, and that results in in using TLS1.0 only. On 10/15/2014 7:48 AM, Giles Coochey wrote: On 15/10/2014 13:42, John Blaut wrote: Hi Following the recent announcement of the SSLv3 POODLE vulnerability (CVE-2014-3

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread John Blaut
Thanks for your reply. Kindly note that for SSL on Tomcat, I do not use the standard JSSE SSL but OpenSSL via APR/native. According to the documentation, the SSL protocols can be configured in this manner for APR/native: "SSLProtocolProtocol which may be used for communicating with clients. T

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread John Blaut
I am using Tomcat 7. I can reproduce the issue even on Native 1.1.30. On Wed, Oct 15, 2014 at 3:00 PM, James Drews wrote: > That isn't working for tomcat 6, it will only accept TLSv1 for the > SSLProtocol entry, and that results in in using TLS1.0 only. > > > On 10/15/2014 7:48 AM, Giles Cooche

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread Giles Coochey
On 15/10/2014 14:03, John Blaut wrote: I am using Tomcat 7. I can reproduce the issue even on Native 1.1.30. Apologies, yes Apr/Native only supports SSLv2, SSLv3 & TLSv1.0 |SSLProtocol| Protocol which may be used for communicating with clients. The default value is |all|, which is equiva

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread John Blaut
When SSLv3 is enabled, it seems TLS1.1 and TLS 1.2 are supported however. It seems strange that the SSLv3 option controls the availability of TLS1.1 and TLS1.2. Now that SSLv3 is considered insecure and more people start to disable it, I suppose many on APR/Native will encounter the same issue. Is

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-15 Thread Mark Eggers
John, > On Wednesday, October 15, 2014 6:20 AM, John Blaut > wrote: > > When SSLv3 is enabled, it seems TLS1.1 and TLS 1.2 are supported however. > It seems strange that the SSLv3 option controls the availability of TLS1.1 > and TLS1.2. > > Now that SSLv3 is considered insecure and more people

RE: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-16 Thread Jeffrey Janner
> -Original Message- > From: Mark Eggers [mailto:its_toas...@yahoo.com.INVALID] > Sent: Wednesday, October 15, 2014 11:57 AM > To: Tomcat Users List > Subject: Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining > support for TLS 1.1 and TLS 1.2 >

Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-16 Thread Mark Eggers
Disabling >> SSLv3 with Tomcat ARP/Native but still retaining support for TLS >> 1.1 and TLS 1.2 >> >> John, >> >> >>> On Wednesday, October 15, 2014 6:20 AM, John Blaut >> wrote: >>>> When SSLv3 is enabled, it seems TLS1.1 and TLS 1.2

RE: Disabling SSLv3 with Tomcat ARP/Native but still retaining support for TLS 1.1 and TLS 1.2

2014-10-16 Thread Jeffrey Janner
Thursday, October 16, 2014 11:30 AM > To: Tomcat Users List > Subject: Re: Disabling SSLv3 with Tomcat ARP/Native but still retaining > support for TLS 1.1 and TLS 1.2 > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On 10/16/2014 9:17 AM, Jeffrey Janner wrote: &