Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.java.programmer > #34150
| Path | csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail |
|---|---|
| From | Robert Klemme <shortcutter@googlemail.com> |
| Newsgroups | comp.lang.java.programmer |
| Subject | Re: One for the encryption experts |
| Date | Sat, 16 Apr 2016 11:49:49 +0200 |
| Lines | 45 |
| Message-ID | <dneg5uFl25pU1@mid.individual.net> (permalink) |
| References | <ner0r1$7j1$1@dont-email.me> |
| Mime-Version | 1.0 |
| Content-Type | text/plain; charset=utf-8; format=flowed |
| Content-Transfer-Encoding | 7bit |
| X-Trace | individual.net hDOop7/p/iDFRdaDoxI52gNEhOw28WCXVbMO1IvG+FJ/BgTJU= |
| Cancel-Lock | sha1:ASGClABPVEsDMIJaTFalpzUZtbs= |
| User-Agent | Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 |
| In-Reply-To | <ner0r1$7j1$1@dont-email.me> |
| Xref | csiph.com comp.lang.java.programmer:34150 |
Show key headers only | View raw
On 15.04.2016 17:23, Duncan Idaho wrote: > The Question is: > > Am I going insane,and, if not, does anyone have any idea how to fix the > problem described below. Just to exclude one obvious item: are you using Apache Native library on any of the two deployments by any chance? > It all works apart from the key exchange which the Chrome browser > bitches about. It tells me that the server uses RSA as the key exchange > mechanism and it's not happy about that. > > It used to run under Java 1.7.0_45 but in an attempt to fix problems > with the key exchange cipher suite I now have it running under > Java 1.8.0_77-b03. The processor architecture is i586 and tomcat is > hosted on CentOS by a large hosting company. 32 bit architecture for a server? That seems odd these days. > The cipher it should use is ECDHE_RSA, I know this because I have the > same version of Tomcat using the same version of Java 1.8.0_77-b03 but > for the x64 processor architecture on my home network running on Ubuntu > Linux, Chrome is quite happy with this cipher apparently. I would test with openssl with verbose output switched on to see and understand what is going on during the handshake. > The really bizarre thing is that ECDHE ciphers are available for the x64 > architecture but not for the i586 architecture. Is this really the case > or am I actually going insane. It could also be different configurations. I am not an expert for SSL either but I would check with openssl to get an idea what is used. Then I'd check configurations. I seem to remember that some ciphers might not be available in some Java packages because of export regulation. Kind regards robert -- remember.guy do |as, often| as.you_can - without end http://blog.rubybestpractices.com/
Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-15 16:23 +0100
Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 11:49 +0200
Re: One for the encryption experts Nemo <nemo@invalid.invalid> - 2016-04-16 08:44 -0400
Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 16:03 +0100
Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 17:13 +0200
Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 17:42 +0100
csiph-web