Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #34153

Re: One for the encryption experts

Show all headers | View raw

On 16/04/16 13:44, Nemo wrote:
> On 16/04/2016 05:49, Robert Klemme wrote:
>> On 15.04.2016 17:23, Duncan Idaho wrote:
>>> [../] tomcat is hosted on CentOS by a large hosting company.
> [...]
>> It could also be different configurations. I am not an expert for SSL
>> either but I would check with openssl to get an idea what is used. Then
>> I'd check configurations. I seem to remember that some ciphers might not
>> be available in some Java packages because of export regulation.
>
> Older versions of CentOS shipped with OpenSSL built without ECC.  I
> concur in checking what suites are supported on the server.  (Something
> such as "openssl ciphers" should give you the list.)
>
> N.

Thanks for your help

Something Robert said jogged the old gray matter (old being the 
operative word)

I was in a hurry to get the server up so I just copied an old setup I 
had and it worked, now don't shout at me but ...

I run Tomcat on port 80 using jsvc 
(https://commons.apache.org/proper/commons-daemon/). I agree that the 
requirement for the i586 package should have rung a bell but it didn't, 
so I compiled jsvc on a 64 bit Linux box on my home network passing the 
x64 Java to the compiler, copied the new jsvc to the remote server, 
updated tomcat.service,  systemctl daemon-reload, systemctl start 
tomcat.service and bingo,
tomcat 7 runs against 64 bit vm and Chrome doesn't barf any more, modern 
cipher suits.

Serves me right for trying to take shortcuts.

ssl labs still only gives me a B, something about weak diffie-helman key 
exchanges but hopefully I can sleep nights again.

Y'know what, I've been trying to track this down for a while now and 
once again only c.l.j.p really helped.

Thanks for that, my sanity is safe (for a while anyway)

Duncan

-- 
Duncan Idaho

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-15 16:23 +0100
  Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 11:49 +0200
    Re: One for the encryption experts Nemo <nemo@invalid.invalid> - 2016-04-16 08:44 -0400
      Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 16:03 +0100
        Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 17:13 +0200
          Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 17:42 +0100

csiph-web