Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.java.programmer > #34150
| From | Robert Klemme <shortcutter@googlemail.com> |
|---|---|
| Newsgroups | comp.lang.java.programmer |
| Subject | Re: One for the encryption experts |
| Date | 2016-04-16 11:49 +0200 |
| Message-ID | <dneg5uFl25pU1@mid.individual.net> (permalink) |
| References | <ner0r1$7j1$1@dont-email.me> |
On 15.04.2016 17:23, Duncan Idaho wrote: > The Question is: > > Am I going insane,and, if not, does anyone have any idea how to fix the > problem described below. Just to exclude one obvious item: are you using Apache Native library on any of the two deployments by any chance? > It all works apart from the key exchange which the Chrome browser > bitches about. It tells me that the server uses RSA as the key exchange > mechanism and it's not happy about that. > > It used to run under Java 1.7.0_45 but in an attempt to fix problems > with the key exchange cipher suite I now have it running under > Java 1.8.0_77-b03. The processor architecture is i586 and tomcat is > hosted on CentOS by a large hosting company. 32 bit architecture for a server? That seems odd these days. > The cipher it should use is ECDHE_RSA, I know this because I have the > same version of Tomcat using the same version of Java 1.8.0_77-b03 but > for the x64 processor architecture on my home network running on Ubuntu > Linux, Chrome is quite happy with this cipher apparently. I would test with openssl with verbose output switched on to see and understand what is going on during the handshake. > The really bizarre thing is that ECDHE ciphers are available for the x64 > architecture but not for the i586 architecture. Is this really the case > or am I actually going insane. It could also be different configurations. I am not an expert for SSL either but I would check with openssl to get an idea what is used. Then I'd check configurations. I seem to remember that some ciphers might not be available in some Java packages because of export regulation. Kind regards robert -- remember.guy do |as, often| as.you_can - without end http://blog.rubybestpractices.com/
Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-15 16:23 +0100
Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 11:49 +0200
Re: One for the encryption experts Nemo <nemo@invalid.invalid> - 2016-04-16 08:44 -0400
Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 16:03 +0100
Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 17:13 +0200
Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 17:42 +0100
csiph-web