Re: Can tomcat be configured for ECDHE and DHE cipher suites

2016-05-25 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mark, On 5/25/16 10:38 AM, Mark Thomas wrote: > On 25/05/2016 15:17, Utkarsh Dave wrote: >> Hello Mark, >> >> I have a question for SSL Support - BIO and NIO. It is mention >> that useServerCipherSuitesOrder can be used with Java 8 only So >> is ther

Re: Can tomcat be configured for ECDHE and DHE cipher suites

2016-05-25 Thread Mark Thomas
On 25/05/2016 15:17, Utkarsh Dave wrote: > Hello Mark, > > I have a question for SSL Support - BIO and NIO. > It is mention that useServerCipherSuitesOrder can be used with Java 8 only > So is there a way (in java 7 and BIO and NIO support ) or another parameter > we can use with "ciphers" to forc

Re: Can tomcat be configured for ECDHE and DHE cipher suites

2016-05-25 Thread Utkarsh Dave
Hello Mark, I have a question for SSL Support - BIO and NIO. It is mention that useServerCipherSuitesOrder can be used with Java 8 only So is there a way (in java 7 and BIO and NIO support ) or another parameter we can use with "ciphers" to force client follow the order of ciphers. The JSSE imple

Re: Can tomcat be configured for ECDHE and DHE cipher suites

2016-05-20 Thread Utkarsh Dave
Thanks Mark. It appears it is client (3rd party which requests to tomcta) to choose the cipher while negotiating. We can use SSLHonorCipherOrder to enforce the server's cipher order. I guess i got my answer. -Thanks Utkarsh Dave On Fri, May 20, 2016 at 4:51 PM, Mark Thomas wrote: > On 20/05/201

Re: Can tomcat be configured for ECDHE and DHE cipher suites

2016-05-20 Thread Mark Thomas
On 20/05/2016 12:18, Utkarsh Dave wrote: > Hi Mark - Thanks. > SSLHonorCipherOrder, cna it be configured on Tomcat ? There would not have been much point telling you about a configuration option you could not use would there? It sounds like you need to spend a few minutes looking over the TLS con

Re: Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Utkarsh Dave
Hi Mark - Thanks. SSLHonorCipherOrder, cna it be configured on Tomcat ? -thanks On Fri, May 20, 2016 at 4:42 PM, Mark Thomas wrote: > On 20/05/2016 12:04, Jan Dosoudil wrote: > > Hi, > > do you have Java Cryptography Extension (JCE) Unlimited Strength > > Jurisdiction Policy Files installed? >

Re: Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Mark Thomas
On 20/05/2016 12:04, Jan Dosoudil wrote: > Hi, > do you have Java Cryptography Extension (JCE) Unlimited Strength > Jurisdiction Policy Files installed? Irrelevant. The OP is using APR / OpenSSL. The available ciphers are controlled by the SSLCipherSuite which follows the OpenSSL config rules for

Re: Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Utkarsh Dave
I have them (US_export_policy.jar and local_policy.jar) under jdk1.7.0_101/jre/lib/security/ On Fri, May 20, 2016 at 4:34 PM, Jan Dosoudil wrote: > Hi, > do you have Java Cryptography Extension (JCE) Unlimited Strength > Jurisdiction Policy Files installed? > > JD > > 2016-05-20 12:50 GMT+02:00

Re: Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Jan Dosoudil
Hi, do you have Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files installed? JD 2016-05-20 12:50 GMT+02:00 Utkarsh Dave : > Sorry, I missed that information in my earlier mail. > Tomcat - 7.0.69 configured for SSL > Connector - APR > Java - jdk1.7.0_101 > > > On Fri

Re: Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Utkarsh Dave
Sorry, I missed that information in my earlier mail. Tomcat - 7.0.69 configured for SSL Connector - APR Java - jdk1.7.0_101 On Fri, May 20, 2016 at 4:10 PM, Mark Thomas wrote: > On 20/05/2016 11:37, Utkarsh Dave wrote: > > Hi Users and Tomcat team, > > > > Port 8443 on my product is configured

Re: Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Mark Thomas
On 20/05/2016 11:37, Utkarsh Dave wrote: > Hi Users and Tomcat team, > > Port 8443 on my product is configured for Tomcat and accepts inbound > traffic from 3rd parties. > In the TLS handshake, Tomcat chooses TLS_RSA_WITH_AES_256_CBC_SHA over some > of the more secure cipher options offered by the

Can tomcat be configured for ECDHE and DHE cipher suites !

2016-05-20 Thread Utkarsh Dave
Hi Users and Tomcat team, Port 8443 on my product is configured for Tomcat and accepts inbound traffic from 3rd parties. In the TLS handshake, Tomcat chooses TLS_RSA_WITH_AES_256_CBC_SHA over some of the more secure cipher options offered by the 3rd party. The 3rd party offers a list of 66 cipher