Strange goings on with Java 8 on a customer box, and java security
"James H. H. Lampert" <jamesl-6/ELSmrcqeUu8xhjR5IN5AC/[email protected]>
| Newsgroups | gmane.comp.lang.as400.java |
|---|---|
| Message-ID | <[email protected]> |
On two of our customer Tomcat installations, we are getting some strange problems that we had solved quite some time ago, but the solution isn't working. On these particular boxes, we have Tomcat running under Java 8, and our webapp context is having trouble accessing a Google address-check web service, and returning this error message: > Unable to find acceptable protocols. isFallback=false, modes=[ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_2, TLS_1_1, TLS_1_0], supportsTlsExtensions=true), ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_ SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AE S_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_0], supportsTlsExtensions=true), ConnectionSpec()], supported protocols=[TLSv1] In the past, we learned that this was happening because IBM was not accepting DESede. The solution was to add a "setenv.sh" file to Tomcat, with (pathnames altered to protect the innocent): > JAVA_OPTS="$JAVA_OPTS -Djava.security.properties=/foo/tomcat/java.security" and then add a security override file at /foo/tomcat/java.security containing: > jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ > EC keySize < 224, anon, NULL (A much cruder solution was to alter the JVM's own java.security file with the above change.) But for some reason, that isn't working in these particular installations, even thougha WRKJVMJOB shows that the setenv.sh file is getting picked up correctly. Anybody got any ideas of what could be going wrong? -- JHHL -- This is the Java Programming on and around the IBM i (JAVA400-L) mailing list To post a message email: [email protected] To subscribe, unsubscribe, or change list options, visit: https://lists.midrange.com/mailman/listinfo/java400-l or email: JAVA400-L-request-+hD5IHI5Xscn3HwCXmMcX9BPR1lH4CV8@public.gmane.org Before posting, please take a moment to review the archives at https://archive.midrange.com/java400-l. Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com