I've tried both parameters
.. sslProtocols = "TLSv1.2,TLSv1.1,TLSv1"
.. sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
and I receive the same results. I'm able to connect with openssl s_client
connect ipa001.local:9443 -ssl3. I've even specifically disabled the cipher
that is negotiated in the connection, but it doesn't appear that what I'm
trying works.
ssl3Ciphers="-DHE-RSA-AES256-SHA"
# openssl s_client -connect en3021s.dev.ca1.sfmc.co:9443 -ssl3
...
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 2763 bytes and written 349 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : SSLv3
Cipher : DHE-RSA-AES256-SHA
...
I've even tried setting JAVA_HOME in /etc/pki-cad/tomcat6.conf to my
openjdk7 install, thinking that maybe it was a java thing, but the same
issue arises. I'm out of ideas, other than to try to upgrade to a newer
version of freeipa server, and subsequently tomcat, which is a task I'm not
looking forward to.
Terry
On Tue, Jan 14, 2020 at 7:20 AM Florence Blanc-Renaud via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
On 1/14/20 11:58 AM, Mauricio Tavares via FreeIPA-users wrote:
> On Tue, Jan 14, 2020 at 4:16 AM Florence Blanc-Renaud via
> FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote:
>>
>> On 1/13/20 8:38 PM, Terry Soucy via FreeIPA-users wrote:
>>> We are running FreeIPA 3.0.0 on CentOS 6 (directly from the OS
>>> repository). I am having trouble disabling SSL3 and RC4 ciphers on port
>>> 9443 (pki-cad)
>>>
>>> ipa-server-3.0.0
>>> tomcat6-6.0.24
>>>
>>> I've been modifying /etc/pki-ca/server.xml with little success. What am
>>> I missing? I've been banging my head on this for the past week.
>>>
>>> <Connector name="Agent" port="9443"
protocol="HTTP/1.1"
>>> SSLEnabled="true"
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
>>
>> I believe the correct parameter name is sslProtocols="...", not
>> sslEnabledProtocols, in this version of tomcat.
>> flo
>>
>
> If we take a look at the latest
> (
https://tomcat.apache.org/tomcat-9.0-doc/config/http.html) docs, it
> says sslEnabledProtocols is an alias to the protocols entry in
> SSLHostConfig (
https://tomcat.apache.org/tomcat-9.0-doc/config/http.html#SSL_Support_-_S...
),
Hi,
Terry stated that he is using ipa-server-3.0.0 with tomcat6-6.0.24.
https://access.redhat.com/solutions/1232233 mentions that for this
version the value sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" should be
used. For Tomcat 6 (6.0.38 and later) and 7,
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" can be used.
flo
> which specifically lists
>
> SSLv2Hello
> SSLv3
> TLSv1
> TLSv1.1
> TLSv1.2
> TLSv1.3
> all
>
> as valid entries. I will agree that the explanation of sslProtocol is
> kinda confusing because it kinda implies it is "the protocol(s) to
> use," with TLS as the default. Maybe the subtle difference is that
> sslEnabledProtocols is the list of "protocols to support when
> *communicating with clients*" the latter part is what differentiates
> it. In any case, in my ancient notes I seem to explicitly define both
> (was the order in sslEnabledProtocols important?):
>
> <Connector port="443" protocol="HTTP/1.1"
SSLEnabled="true"
> maxThreads="150" scheme="https"
secure="true"
> keystoreFile="/usr/share/tomcat/keystore"
> keystorePass="password1" keyAlias="tomcat"
> clientAuth="false"
> sslProtocol="TLS"
sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"
> />
>
>
>>> scheme="https" secure="true"
>>> maxHttpHeaderSize="8192"
>>> acceptCount="100" maxThreads="150"
minSpareThreads="25"
>>> maxSpareThreads="75"
>>> enableLookups="false"
disableUploadTimeout="true"
>>>
>>>
SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
>>> enableOCSP="false"
>>>
ocspResponderURL="http://ipa001.local:9080/ca/ocsp"
>>> ocspResponderCertNickname="ocspSigningCert
cert-pki-ca"
>>> ocspCacheSize="1000"
>>> ocspMinCacheEntryDuration="60"
>>> ocspMaxCacheEntryDuration="120"
>>> ocspTimeout="10"
>>> clientAuth="true"
>>> sslOptions="ssl2=false,ssl3=false,tls=true"
>>>
>>>
tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,-SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,-SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,-SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-EDH-RSA-DES-CBC3-SHA,-DES-CBC3-SHA"
>>> sslVersionRangeStream="tls1_1:tls1_2"
>>> sslVersionRangeDatagram="tls1_1:tls1_2"
>>>
>>>
sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"
>>>
>>>
>>> serverCertNickFile="/var/lib/pki-ca/conf/serverCertNick.conf"
>>>
passwordFile="/var/lib/pki-ca/conf/password.conf"
>>>
>>>
passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
>>> certdbDir="/var/lib/pki-ca/alias"
>>> />
>>>
>>> --
>>> Terry Soucy
>>> Systems Engineering Lead | Salesforce
>>> Mobile: +1.506.609.3247
>>>
>>>
>>> <
http://smart.salesforce.com/sig/tsoucy//ca_mb/default/link.html>
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
Terry Soucy
Systems Engineering Lead | Salesforce
Mobile: +1.506.609.3247
<