Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an application deployed on tomcat with a JSSE https connector. When I try to connect to this site with default iPad browser, I always get an error message about the connection cannot be established.

I used the command line tool "ssldump" to check what happens and it seems the problem is in the cipher suite used by iPad: none of the ciphers is accepted by the server.

This is what ssldump command show:

New TCP connection #1: host35-105-static.24-87-b.business.telecomitalia.it(59049) <-> 192.168.1.55(8443)
1 1  0.0979 (0.0979)  C>S  Handshake
  ClientHello
    Version 3.3 
    cipher suites
    TLS_RSA_WITH_AES_128_CBC_SHA
    TLS_RSA_WITH_RC4_128_SHA
    TLS_RSA_WITH_RC4_128_MD5
    TLS_RSA_WITH_AES_256_CBC_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA
    TLS_DHE_DSS_WITH_NULL_SHA
    TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    TLS_DHE_RSA_WITH_AES_256_CBC_SHA
    TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
    TLS_RSA_WITH_NULL_SHA
    TLS_RSA_WITH_NULL_MD5
    compression methods
              NULL

iPad does try a few times, changing the version number, but it fails every time and eventually stop.

When connecting using Chrome on the very same iPad, the connection works. The relevant dump is:

New TCP connection #1: host35-105-static.24-87-b.business.telecomitalia.it(59049) <-> 192.168.1.55(8443)
1 1  0.0979 (0.0979)  C>S  Handshake
  ClientHello
    Version 3.3 
    cipher suites
    TLS_RSA_WITH_AES_128_CBC_SHA
    TLS_RSA_WITH_RC4_128_SHA
    TLS_RSA_WITH_RC4_128_MD5
    TLS_RSA_WITH_AES_256_CBC_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA
    TLS_DHE_DSS_WITH_NULL_SHA
    TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    TLS_DHE_RSA_WITH_AES_256_CBC_SHA
    TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
    TLS_RSA_WITH_NULL_SHA
    TLS_RSA_WITH_NULL_MD5
    compression methods
              NULL

Ths cipher accepted by the server is: TLS_DHE_DSS_WITH_AES_128_CBC_SHA

So, my question: how to configure tomcat for accepting a broader range of ciphers, or at least to accept even one of those used by this browser?

Please note that tomcat uses latest jdk 1.6 with jce unrestricted policy. I also added bouncy castle jar in jre/lib/ext and added its provider in jre/lib/security/java.security as last in the provider list. After restarting tomcat nothing changed.

Thank you very much

Update: The connector I use is:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false"
           sslProtocol="TLS"
           proxyName="www.my-visible-name.tld"
           proxyPort="8443"
           address="192.168.1.55"
/>

This is a JSSE connector since it display this message in log file:

13-feb-2013 12.57.49 org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-192.168.1.55-8443

Update 2: A complete log from ssldump when connecting with safari on iPad is available here. I start thinking this is not a problem of cipher, but of protocol version. In fact, I checked the complete list of available ciphers and there are a few matching. Should I try changing the sslProtocol from TLS so some SSLv?.

share|improve this question
    
Can you post the ssl listener portion from your server.xml file? Also, the two ssldump captures above look identical. Are they the same dump? –  mahnsc Feb 14 '13 at 13:21
    
You are right. I just collected a complete dump when using Safari. It is available here. –  eppesuig Feb 15 '13 at 9:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.