Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Robert Klemme Newsgroups: comp.lang.java.programmer Subject: Re: One for the encryption experts Date: Sat, 16 Apr 2016 11:49:49 +0200 Lines: 45 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net hDOop7/p/iDFRdaDoxI52gNEhOw28WCXVbMO1IvG+FJ/BgTJU= Cancel-Lock: sha1:ASGClABPVEsDMIJaTFalpzUZtbs= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 In-Reply-To: Xref: csiph.com comp.lang.java.programmer:34150 On 15.04.2016 17:23, Duncan Idaho wrote: > The Question is: > > Am I going insane,and, if not, does anyone have any idea how to fix the > problem described below. Just to exclude one obvious item: are you using Apache Native library on any of the two deployments by any chance? > It all works apart from the key exchange which the Chrome browser > bitches about. It tells me that the server uses RSA as the key exchange > mechanism and it's not happy about that. > > It used to run under Java 1.7.0_45 but in an attempt to fix problems > with the key exchange cipher suite I now have it running under > Java 1.8.0_77-b03. The processor architecture is i586 and tomcat is > hosted on CentOS by a large hosting company. 32 bit architecture for a server? That seems odd these days. > The cipher it should use is ECDHE_RSA, I know this because I have the > same version of Tomcat using the same version of Java 1.8.0_77-b03 but > for the x64 processor architecture on my home network running on Ubuntu > Linux, Chrome is quite happy with this cipher apparently. I would test with openssl with verbose output switched on to see and understand what is going on during the handshake. > The really bizarre thing is that ECDHE ciphers are available for the x64 > architecture but not for the i586 architecture. Is this really the case > or am I actually going insane. It could also be different configurations. I am not an expert for SSL either but I would check with openssl to get an idea what is used. Then I'd check configurations. I seem to remember that some ciphers might not be available in some Java packages because of export regulation. Kind regards robert -- remember.guy do |as, often| as.you_can - without end http://blog.rubybestpractices.com/