0

I'm trying to configure a Tomcat 7 TLS connector for best possible security. To test, I'm allowing the Qualsys test to run against my server.

However I keep failing on the following points:

  • This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C
  • This server uses RC4 with modern protocols. Grade capped to C.
  • The server does not support Forward Secrecy with the reference browsers

Here is my connector configuration:

<Connector port="443"
           maxHttpHeaderSize="16384"
           connectionTimeout="30000"
           enableLookups="false"
           URIEncoding="UTF-8"
           disableUploadTimeout="true"
           server="Java Application"
           SSLEnabled="true"
           scheme="https"
           secure="true"
           sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
           sslProtocol="TLS"
           keystoreFile="./certs/keystore.jks"
           keystorePass="changeit"
           keystoreType="jks"
           keyAlias="devserver.dev.net"
           truststoreFile="./certs/truststore.jks"
           truststorePass="changeit"
           truststoreType="jks"
           clientAuth="false"
     ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
        TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,
        TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"

/>

I've Googled this to death, but can't find a combination that will resolve the problems found.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.