Re: Problem in connecting to Java (Tomcat) server with ECDHE ciphers

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Thanks Steven for pointing me in the right direction: when I switched to an EC/ECDSA key for tomcat then openssl could connect using ECDHE-ECDSA-AES256-GCM-SHA384.

 

But only after installing the unlimited strength policy files on the server, with the defaults the best was ECDHE-ECDSA-AES128-GCM-SHA256.

 

Andrew

 

From: openssl-users [mailto:openssl-users-bounces@xxxxxxxxxxx] On Behalf Of Steven Collison
Sent: Tuesday, June 06, 2017 07:30
To: openssl-users@xxxxxxxxxxx
Cc: openssl-dev@xxxxxxxxxxx
Subject: Re: [openssl-users] Problem in connecting to Java (Tomcat) server with ECDHE ciphers

 

As a sanity check, are you using an ECDSA certificate on your Tomcat server? ECDHE-ECDSA-AES256-GCM-SHA384 can’t be negotiated without one. Perhaps you can try
openssl s_client -connect a.b.c.d:<port> -msg -debug -cipher “ECDHE-RSA-AES256-GCM-SHA384” if you’re using an RSA cert.

-Steven

On 3 Jun 2017, at 22:01, Pravesh Rai wrote:

Hi,

Even though I've disabled SSLvX protocols on both - client (openssl-1.0.2k)
& server (Java 1.8 with Tomcat), still getting following handshake error,
while executing:

"openssl s_client -connect a.b.c.d:<port> -msg -debug -cipher
ECDHE-ECDSA-AES256-GCM-SHA384"


...
read from 0x213f50 [0x21c410] (7 bytes => 7 (0x7))
0000 - 15 03 03 00 02 02 28 ......(
<<< TLS 1.2 [length 0005]
15 03 03 00 02
<<< TLS 1.2 Alert [length 0002], fatal handshake_failure
02 28
14756:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert
handshake failure:.\ssl\s23_clnt.c:769:
...

And, such error happens, only when ECDHE ciphers are selected during the
connection.

Any clue on this?

Thanks,
PR
--
openssl-users mailing list
To unsubscribe:
https://mta.openssl.org/mailman/listinfo/openssl-users

-- 
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux