CODEWITHSUNDEEP
sslhttpsconfigurationjava-8tomcat8
M. Ozn
M. Ozn

Reputation: 1220

Tomcat8 SSL connector

I followed the official tutorial to install ssl on tomcat8 but my browser is giving me a ERR_SSL_VERSION_OR_CIPHER_MISMATCH error.

First of all I give you the informations about the server :

I use https://10.1.5.55:8200/ as url to connect to my server (which is working with the http protocol)

The first thing which confused me was the fact that all tutorial are talking about connector like :

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" .../>

But the basic config file server.xml provides me this template :

<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true" >
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig>
            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
                         certificateFile="conf/localhost-rsa-cert.pem"
                         certificateChainFile="conf/localhost-rsa-chain.pem"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>

Anyway I followed up the tutorial and generated my keystore under E:\keys :

keytool -genkey -alias myapp -keystore myapp-keystore

In First and Last Name I typed : 10.1.5.55:8200 Password : changeit I pressed return to get the same password for the key.

Then I wrote my connector like it (I modified the http port to run on 8199) :

<Connector
    port="8200" 
    protocol="org.apache.coyote.http11.Http11NioProtocol" 
    SSLEnabled="true" 
    maxThreads="300" 
    scheme="https" 
    secure="true" 
    clientAuth="false" 
    sslProtocol="TLS" 
    keystoreFile="E:\keys\myapp-keystore" 
    keystorePass="changeit"
/>

But I got the error at this point.

Now there are all solutions I tried :

And finally I tried to add ciphers. Here is the list I used :

ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, 
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, 
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, 
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, 
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, 
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, 
TLS_DHE_DSS_WITH_AES_256_CBC_SHA, 
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, 
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, 
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, 
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, 
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, 
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, 
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, 
TLS_ECDH_ECDSA_WITH_RC4_128_SHA, 
TLS_ECDH_RSA_WITH_RC4_128_SHA, 
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 
TLS_RSA_WITH_AES_256_GCM_SHA384, 
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, 
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, 
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, 
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 
TLS_RSA_WITH_AES_128_GCM_SHA256, 
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, 
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, 
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, 
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, 
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, 
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, 
TLS_EMPTY_RENEGOTIATION_INFO_SCSVF 
"

I got this list from here and here I learned that Tomcat7 w/ Java7 works differently than Tomcat8 w/ Java8. I tried, as it's recommended here, to remove "sslProtocol" and add "useServerCipherSuitesOrder" but nothing worked, always the same error from my browser.

Please someone can tell me how to solves this ?

Upvotes: 2

Views: 792

Answers (1)

pedrofb
pedrofb

Reputation: 39241

You are generating a DSA certificate of 1024 bits and Chrome stops/stopped supporting DSA(DSS) as shown also here or here. Try to generate a RSA certificate of 2048 bits

Replace this command 

keytool -genkey -alias myapp -keystore myapp-keystore

with 

keytool -genkey -alias myapp -keystore myapp-keystore -keyalg RSA

Upvotes: 3

Related Questions