Path: csiph.com!news.swapon.de!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Duncan Idaho Newsgroups: comp.lang.java.programmer Subject: Re: One for the encryption experts Date: Sat, 16 Apr 2016 16:03:52 +0100 Organization: A noiseless patient Spider Lines: 48 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Sat, 16 Apr 2016 15:00:34 -0000 (UTC) Injection-Info: mx02.eternal-september.org; posting-host="9ff7b29a883d04825db2ecb4d9c9cb46"; logging-data="9856"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19jiTYPnWH+/EeILGTDqxrvN5IjtB2xlt0=" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 In-Reply-To: Cancel-Lock: sha1:pb4Gew4pq6L+AB5ZorpbVS03sxA= Xref: csiph.com comp.lang.java.programmer:34153 On 16/04/16 13:44, Nemo wrote: > On 16/04/2016 05:49, Robert Klemme wrote: >> On 15.04.2016 17:23, Duncan Idaho wrote: >>> [../] tomcat is hosted on CentOS by a large hosting company. > [...] >> It could also be different configurations. I am not an expert for SSL >> either but I would check with openssl to get an idea what is used. Then >> I'd check configurations. I seem to remember that some ciphers might not >> be available in some Java packages because of export regulation. > > Older versions of CentOS shipped with OpenSSL built without ECC. I > concur in checking what suites are supported on the server. (Something > such as "openssl ciphers" should give you the list.) > > N. Thanks for your help Something Robert said jogged the old gray matter (old being the operative word) I was in a hurry to get the server up so I just copied an old setup I had and it worked, now don't shout at me but ... I run Tomcat on port 80 using jsvc (https://commons.apache.org/proper/commons-daemon/). I agree that the requirement for the i586 package should have rung a bell but it didn't, so I compiled jsvc on a 64 bit Linux box on my home network passing the x64 Java to the compiler, copied the new jsvc to the remote server, updated tomcat.service, systemctl daemon-reload, systemctl start tomcat.service and bingo, tomcat 7 runs against 64 bit vm and Chrome doesn't barf any more, modern cipher suits. Serves me right for trying to take shortcuts. ssl labs still only gives me a B, something about weak diffie-helman key exchanges but hopefully I can sleep nights again. Y'know what, I've been trying to track this down for a while now and once again only c.l.j.p really helped. Thanks for that, my sanity is safe (for a while anyway) Duncan -- Duncan Idaho