I'm trying to specify which cipher suites should be used in my Tomcat configuration like so:
<Connector
port="9443"
protocol="org.apache.coyote.http11.Http11Protocol"
enableLookups="false"
SSLEnabled="true"
scheme="https"
secure="true"
clientAuth="want"
keystoreFile="{omitted}"
SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_SHA,
TLS_ECDHE_ECDSA_WITH_AES_128_SHA,
TLS_ECDHE_RSA_WITH_AES_256_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_SHA,
TLS_ECDHE_ECDSA_WITH_AES_256_SHA,
TLS_DHE_RSA_WITH_AES_128_SHA256,
TLS_DHE_RSA_WITH_AES_128_SHA,
TLS_DHE_DSS_WITH_AES_128_SHA256,
TLS_DHE_RSA_WITH_AES_256_SHA256,
TLS_DHE_DSS_WITH_AES_256_SHA,
TLS_DHE_RSA_WITH_AES_256_SHA"
/>
However, when checking the server with Qualy SSL Labs, I get capped at grade F for providing support for unsafe ciphers like
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67)
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16)
etc.
These suites don't appear in the connector's ciphers
attribute and I have no clue where they are taken from. Any hints on why the ciphers list from the connector element seems to be ignored?
Tomcat version is 6.0.24.
Update: Even more interestingly, Qualys states that a possible cipher suite is
TLS_RSA_WITH_RC4_128_MD5
while this doesn't appear in the docs listing the available suites.
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 9443
(not added by me), I read it as "Redirect any incoming traffic on port 443 to port 9443"? If yes, the above connector should be used, I think?