1

I'm trying to specify which cipher suites should be used in my Tomcat configuration like so:

<Connector
    port="9443"
    protocol="org.apache.coyote.http11.Http11Protocol"
    enableLookups="false"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    clientAuth="want"
    keystoreFile="{omitted}"
    SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
    sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2"
    ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
             TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
             TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
             TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
             TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
             TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
             TLS_ECDHE_RSA_WITH_AES_128_SHA256,
             TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,
             TLS_ECDHE_RSA_WITH_AES_128_SHA,
             TLS_ECDHE_ECDSA_WITH_AES_128_SHA,
             TLS_ECDHE_RSA_WITH_AES_256_SHA384,
             TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,
             TLS_ECDHE_RSA_WITH_AES_256_SHA,
             TLS_ECDHE_ECDSA_WITH_AES_256_SHA,
             TLS_DHE_RSA_WITH_AES_128_SHA256,
             TLS_DHE_RSA_WITH_AES_128_SHA,
             TLS_DHE_DSS_WITH_AES_128_SHA256,
             TLS_DHE_RSA_WITH_AES_256_SHA256,
             TLS_DHE_DSS_WITH_AES_256_SHA,
             TLS_DHE_RSA_WITH_AES_256_SHA"
/>

However, when checking the server with Qualy SSL Labs, I get capped at grade F for providing support for unsafe ciphers like

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67)

TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16)

etc.

These suites don't appear in the connector's ciphers attribute and I have no clue where they are taken from. Any hints on why the ciphers list from the connector element seems to be ignored?

Tomcat version is 6.0.24.

Update: Even more interestingly, Qualys states that a possible cipher suite is

TLS_RSA_WITH_RC4_128_MD5

while this doesn't appear in the docs listing the available suites.

2
  • And you don't have a webserver running on the default SSL port (443) that gets scanned instead of Tomcat?
    – HBruijn
    May 26, 2015 at 12:23
  • In the iptables-file, there is this line: -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 9443 (not added by me), I read it as "Redirect any incoming traffic on port 443 to port 9443"? If yes, the above connector should be used, I think?
    – Thaoden
    May 26, 2015 at 12:35

0

You must log in to answer this question.

Browse other questions tagged .