Re: tomcat 8.5 TLS cipher strings

2020-11-18 Thread Baron Fujimoto
On Wed, Nov 18, 2020 at 04:45:05PM +, Mark Thomas wrote: On 18/11/2020 03:07, Baron Fujimoto wrote: On Mon, Nov 16, 2020 at 09:47:03AM +, Mark Thomas wrote: Have you tried adding ":-AES:+AESGCM" to the cipher string you are already using? I hadn't (did I miss where these were docu

Re: tomcat 8.5 TLS cipher strings

2020-11-18 Thread Mark Thomas
On 18/11/2020 03:07, Baron Fujimoto wrote: > On Mon, Nov 16, 2020 at 09:47:03AM +, Mark Thomas wrote: >> Have you tried adding ":-AES:+AESGCM" to the cipher string you are >> already using? > > I hadn't (did I miss where these were documented somewhere?). However it > seems like once I add

Re: tomcat 8.5 TLS cipher strings

2020-11-17 Thread Baron Fujimoto
On Mon, Nov 16, 2020 at 09:47:03AM +, Mark Thomas wrote: On 14/11/2020 00:41, Baron Fujimoto wrote: We're running Tomcat 8.5, currently configured with the following OpenSSL cipher strings in our SSLHostConfig: ciphers="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA:!PSK" However, SSLLabs

Re: tomcat 8.5 TLS cipher strings

2020-11-16 Thread Mark Thomas
On 14/11/2020 00:41, Baron Fujimoto wrote: > We're running Tomcat 8.5, currently configured with the following > OpenSSL cipher strings in our SSLHostConfig: > > ciphers="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA:!PSK" > > However, SSLLabs' server test reports that the following available >

tomcat 8.5 TLS cipher strings

2020-11-13 Thread Baron Fujimoto
We're running Tomcat 8.5, currently configured with the following OpenSSL cipher strings in our SSLHostConfig: ciphers="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA:!PSK" However, SSLLabs' server test reports that the following available ciphers are weak: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA