如何禁用Apache Tomcat中的SSLv3支持?

我正在尝试重新configuration我的Apache Tomcat服务器,只使用TLSv1。 但是,使用某些浏览器的情况下,它仍然会回落到SSLv3。

我使用以下设置来设置<connector>标签:

<Connector ... enableLookups="true" disableUploadTimeout="true" acceptCount="100" maxThreads="200" scheme="https" secure="true" SSLEnabled="true" clientAuth="false" sslProtocol="TLS" ciphers="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA" sslEnabledProtocols="TLSv1" /> 

我是否缺less一个configuration设置或有一些我不应该出现的礼物?

根据Tomcat 5和Version 6的版本,SSLEnabled =“true”可能无法正常工作,因为它是在发行版中添加的。 要通过这个你只需要编辑以下内容:sslProtocols = TLS到:sslProtocols =“TLSv1,TLSv1.1,TLSv1.2”

似乎很奇怪,但即使它说TLS,它包含SSL 3。

这固定在我们的Tomcat 5.5.20和我们的Tomcat 6实例上。 -Greg

我相信你需要做的是:

Jboss的:

 <Connector protocol="HTTP/1.1" SSLEnabled="true" enableLookups="true" disableUploadTimeout="true" acceptCount="100" maxThreads="200" scheme="https" secure="true" clientAuth="false" keystoreFile="${jboss.server.home.dir}/conf/keystore.jks" keystorePass="rmi+ssl" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" /> 

不确定在密码套件定义然而sslprotocols只应该被设置对TLSv1,TLSv1.1,TLSv1.2

取决于你的tomcat版本,它会有所不同,其他可能的解决scheme:

雄猫5和6

 <Connector... enableLookups="true" disableUploadTimeout="true" acceptCount="100" maxThreads="200" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2" /> 

**在基于RHEL5的发行版上,以下内容适用于Tomcat 6.0.38之前的 Tomcat 6版本**

请注意, TLSv1.1,TLSv1.2受Java 7支持,而不受Java 6支持。将这些指令添加到运行Java 6的服务器是无害的,但不会启用TLSv1.1&TLSv1.2。

 <Connector... enableLookups="true" disableUploadTimeout="true" acceptCount="100" maxThreads="200" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" /> 

Tomcat> = 7

 <Connector... enableLookups="true" disableUploadTimeout="true" acceptCount="100" maxThreads="200" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" /> 

Tomcat APR连接器

 <Connector... maxThreads="200" enableLookups="true" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true" SSLProtocol="TLSv1" SSLCertificateFile="${catalina.base}/conf/localhost.crt" SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" /> 

以上是改变,以迎合你的连接器规格以上。 来源: https : //access.redhat.com/solutions/1232233

我有一个类似的用例,就是使Tomcat 7严格使用TLSv1.2,而不是回退到早期的SSL协议,比如TLSv1.1或SSLv3。

我正在使用:C:\ apache-tomcat-7.0.64-64bit和C:\ Java64 \ jdk1.8.0_60。

遵循这个指令: https : //tomcat.apache.org/tomcat-7.0-doc/security-howto.html 。 Tomcat设置SSL支持相对简单。

从很多参考资料我testing了很多组合,最后我发现1将强制Tomcat 7只接受TLSv1.2。 需要触摸2个地方:

1)在C:\ apache-tomcat-7.0.64-64bit \ conf \ server.xml中

 <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" keystoreFile="ssl/.keystore" keystorePass="changeit" clientAuth="false" sslProtocol="SSL" sslEnabledProtocols="TLSv1.2" /> 

哪里

keystoreFile =本地自签名信任存储

org.apache.coyote.http11.Http11Protocol = JSSE BIO实现。

我们不使用org.apache.coyote.http11.Http11AprProtocol ,因为它是由openssl提供的。 底层的openssl将回退到支持早期的SSL协议。

2)启动Tomcat时,启用以下环境参数。

 set JAVA_HOME=C:\Java64\jdk1.8.0_60 set PATH=%PATH%;C:\Java64\jdk1.8.0_60\bin set CATALINA_HOME=C:\apache-tomcat-7.0.64-64bit set JAVA_OPTS=-Djdk.tls.client.protocols="TLSv1.2" -Dsun.security.ssl.allowUnsafeRenegotiation=false -Dhttps.protocols="TLSv1.2" 

JAVA_OPTS限制是必需的,否则Tomcat(由Java8支持)将回退到支持早期的SSL协议。

启动Tomcat C:\apache-tomcat-7.0.64-64bit\bin\startup.bat

我们可以看到JAVA_OPTS出现在Tomcat启动日志中。

 Oct 16, 2015 4:10:17 PM org.apache.catalina.startup.VersionLoggerListener log INFO: Command line argument: -Djdk.tls.client.protocols=TLSv1.2 Oct 16, 2015 4:10:17 PM org.apache.catalina.startup.VersionLoggerListener log INFO: Command line argument: -Dsun.security.ssl.allowUnsafeRenegotiation=false Oct 16, 2015 4:10:17 PM org.apache.catalina.startup.VersionLoggerListener log INFO: Command line argument: -Dhttps.protocols=TLSv1.2 

然后,我们可以使用openssl命令来validation我们的设置。 首先使用TLSv1.1协议连接localhost:8443。 Tomcat拒绝回复服务器证书。

 C:\OpenSSL-Win32\bin>openssl s_client -connect localhost:8443 -tls1_1 Loading 'screen' into random state - done CONNECTED(000001C0) 5372:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:.\ssl\s3_pkt.c:362: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 5 bytes and written 0 bytes 

连接localhost:8443与TLSv1.2协议,Tomcat回复ServerHello与证书:

 C:\OpenSSL-Win32\bin>openssl s_client -connect localhost:8443 -tls1_2 Loading 'screen' into random state - done CONNECTED(000001C0) depth=1 C = US, ST = Washington, L = Seattle, O = getaCert - www.getacert.com verify error:num=19:self signed certificate in certificate chain --- Certificate chain 0 s:/C=SG/ST=SG/L=Singapore/O=Xxxx/OU=Development/CN=Myself i:/C=US/ST=Washington/L=Seattle/O=getaCert - www.getacert.com 1 s:/C=US/ST=Washington/L=Seattle/O=getaCert - www.getacert.com i:/C=US/ST=Washington/L=Seattle/O=getaCert - www.getacert.com --- Server certificate -----BEGIN CERTIFICATE----- (ignored) -----END CERTIFICATE----- subject=/C=SG/ST=SG/L=Singapore/O=Xxxx/OU=Development/CN=Myself issuer=/C=US/ST=Washington/L=Seattle/O=getaCert - www.getacert.com --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 2367 bytes and written 443 bytes 

这certificateTomcat现在只对TLSv1.2请求做出严格响应。

Tomcat 7文档明确指出, sslEnabledProtocolssslProtocol选项是支持的,并且它们之间有重叠:
https://tomcat.apache.org/tomcat-7.0-doc/config/http.html

在Tomcat 6.0.41中,您将需要使用阻塞连接器,因为NIO忽略了这些设置。

http://wiki.apache.org/tomcat/Security/POODLE

http://mail-archives.apache.org/mod_mbox/tomcat-users/201410.mbox/%[email protected]%3E

连接器端口=“443”protocol =“org.apache.coyote.http11.Http11Protocol”maxThreads =“200”scheme =“https”secure =“true”SSLEnabled =“true”clientAuth =“false”
keystoreFile =“tomcat.jks”keystorePass =“changeit”sslEnabledProtocols =“TLSv1,TLSv1.1,TLSv1.2”/>

在Tomcat 5.5中,您应该使用未logging的参数

 protocols="TLSv1" 

限制使用这个协议版本。

要在server.xml中的Jboss 4.0.3 SP1(Tomcat 5.5 with java 1.5)中禁用SSL 3(POODLE),请更改您的代码。

<Connector port="443" address="${jboss.bind.address}" maxThreads="100" strategy="ms" maxHttpHeaderSize="8192" emptySessionPath="true" scheme="https" secure="true" clientAuth="false" keystoreFile="${jboss.server.home.dir}/conf/eCP.keystore" keystorePass="password" sslProtocol="TLS" protocols="TLSv1,TLSv1.1,TLSv1.2" />

对于较新的雄猫使用sslProtocolssslEnabledProtocols组合如下:

<Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocols="TLSv1,TLSv1.1,TLSv1.2" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" SSLEnabled="true" URIEncoding="UTF-8" keystorePass=""/>

首先,正如@iviorel所说,这不是sslProtocols ,而是sslProtocol 。 (为什么他的答案变得下降了?)

JSSE
对于我来说,在Tomcat 7和Java 7上,以下configuration中的sslProtocol不起作用:

 <Connector SSLEnabled="true" clientAuth="false" keyAlias="keyalias" keystoreFile="keystore" keystorePass="changeit" maxThreads="150" port="443" protocol="org.apache.coyote.http11.Http11Protocol" scheme="https" secure="true" sslProtocol="TLSv1,TLSv1.1,TLSv1.2" /> 

它说:

 SEVERE: Failed to initialize end point associated with ProtocolHandler ["http-bio-443"] java.io.IOException: TLSv1,TLSv1.1,TLSv1.2 SSLContext not available at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:465) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:187) at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:398) at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:646) ... Caused by: java.security.NoSuchAlgorithmException: TLSv1,TLSv1.1,TLSv1.2 SSLContext not available at sun.security.jca.GetInstance.getInstance(GetInstance.java:159) at javax.net.ssl.SSLContext.getInstance(SSLContext.java:156) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSSLContext(JSSESocketFactory.java:478) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:439) ... 19 more 

但下面的工作很好:

 <Connector SSLEnabled="true" clientAuth="false" keyAlias="keyalias" keystoreFile="keystore" keystorePass="changeit" maxThreads="150" port="443" protocol="org.apache.coyote.http11.Http11Protocol" scheme="https" secure="true" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" /> 

APR
要禁用SSL v3并启用TLSv1协议,请执行以下操作:

 SSLProtocol="TLSv1" 

要启用TLSv1,TLSv1.1,TLSv1.2协议:

 SSLProtocol="TLSv1+TLSv1.1+TLSv1.2" 

要么:

 SSLProtocol="all" 

注意:“TLSv1.1”,“TLSv1.2”值需要Tomcat Native 1.1.32和支持它的Tomcat版本。