Path: csiph.com!news.swapon.de!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Duncan Idaho Newsgroups: comp.lang.java.programmer Subject: Re: One for the encryption experts Date: Sat, 16 Apr 2016 17:42:36 +0100 Organization: A noiseless patient Spider Lines: 32 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Sat, 16 Apr 2016 16:39:16 -0000 (UTC) Injection-Info: mx02.eternal-september.org; posting-host="9ff7b29a883d04825db2ecb4d9c9cb46"; logging-data="4151"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+zEwd6wS+r92y/h3JiH1N7V9MxX+dij3M=" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 In-Reply-To: Cancel-Lock: sha1:4XB33hSwO3eC9L3HxMAOzTH3DxU= Xref: csiph.com comp.lang.java.programmer:34155 On 16/04/16 16:13, Robert Klemme wrote: > On 16.04.2016 17:03, Duncan Idaho wrote: > >> Something Robert said jogged the old gray matter (old being the >> operative word) > > :-)) > >> Serves me right for trying to take shortcuts. > > Well, that is often what happens: you save time now and pay later. :-) > >> ssl labs still only gives me a B, something about weak diffie-helman key >> exchanges but hopefully I can sleep nights again. > > You could completely disable DH or try to set a min key length of 2k or > more. IIRC only disabling is possible in Java. This does it https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/659/17/how-to----disable-weak-ciphers-in-tomcat-7--8 An 'A' from ssllabs.com I'm off for several beers, there's one in the tap for you guys. Happy days Duncan -- Duncan Idaho