Return-Path: 
 <users-return-47723-apmail-cxf-users-archive=cxf.apache.org@cxf.apache.org>
X-Original-To: apmail-cxf-users-archive@www.apache.org
Delivered-To: apmail-cxf-users-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 7453A18272
	for <apmail-cxf-users-archive@www.apache.org>;
 Mon,  4 May 2015 19:51:03 +0000 (UTC)
Received: (qmail 66880 invoked by uid 500); 4 May 2015 19:51:00 -0000
Delivered-To: apmail-cxf-users-archive@cxf.apache.org
Received: (qmail 66817 invoked by uid 500); 4 May 2015 19:51:00 -0000
Mailing-List: contact users-help@cxf.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:users-help@cxf.apache.org>
List-Unsubscribe: <mailto:users-unsubscribe@cxf.apache.org>
List-Post: <mailto:users@cxf.apache.org>
List-Id: <users.cxf.apache.org>
Reply-To: users@cxf.apache.org
Delivered-To: mailing list users@cxf.apache.org
Received: (qmail 66771 invoked by uid 99); 4 May 2015 19:51:00 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 04 May 2015 19:51:00 +0000
X-ASF-Spam-Status: No, hits=1.6 required=5.0
	tests=FREEMAIL_ENVFROM_END_DIGIT,SPF_PASS,URI_HEX
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: message received from 54.76.25.247 which
 is an MX secondary for users@cxf.apache.org)
Received: from [54.76.25.247] (HELO mx1-eu-west.apache.org) (54.76.25.247)
    by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 04 May 2015 19:50:34 +0000
Received: from mwork.nabble.com (mwork.nabble.com [162.253.133.43])
	by mx1-eu-west.apache.org (ASF Mail Server at mx1-eu-west.apache.org) with
 ESMTP id 2AB20207C4
	for <users@cxf.apache.org>; Mon,  4 May 2015 19:50:33 +0000 (UTC)
Received: from msam.nabble.com (unknown [162.253.133.85])
	by mwork.nabble.com (Postfix) with ESMTP id C12F51D114B0
	for <users@cxf.apache.org>; Mon,  4 May 2015 12:51:11 -0700 (PDT)
Date: Mon, 4 May 2015 12:50:25 -0700 (MST)
From: boca2608 <boca2608@gmail.com>
To: users@cxf.apache.org
Message-ID: <1430769025488-5756962.post@n5.nabble.com>
In-Reply-To: 
 <CAB8XdGC-S+ORYGiX6P6zam_Jamg--BRO79Bat_SJ3KiPTvGinQ@mail.gmail.com>
References: <1430452064664-5756863.post@n5.nabble.com>
 <CAB8XdGC-S+ORYGiX6P6zam_Jamg--BRO79Bat_SJ3KiPTvGinQ@mail.gmail.com>
Subject: Re: CXF 3.0.4 server cannot receive message from TLS1.0 client
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

Hi Colm,

Thank you very much for your response.  I am not sure what you meant by
"complete service configuration" so I copied the entire <engine>
configuration here.  Please let me know if it is something else you would
like to see.

	<httpj:engine-factory bus="cxf">
		
		<httpj:engine port="${my.listener.port}">
			<httpj:tlsServerParameters>
				<sec:keyManagers keyPassword="${my.sslserver.keyalias.password}">
					<sec:keyStore type="${my.sslserver.keystore.type}" 
						password="${my.sslserver.keystore.password}"
						resource="${my.sslserver.keystore}" />
				</sec:keyManagers>
				<sec:trustManagers>
					<sec:keyStore type="${my.sslserver.keystore.type}" 
						password="${my.sslserver.keystore.password}"
						resource="${my.sslserver.keystore}" />
				</sec:trustManagers>

				<sec:cipherSuitesFilter>
					<sec:include>.*_EXPORT_.*</sec:include>
					<sec:include>.*_EXPORT1024_.*</sec:include>
					
					<sec:include>.*_WITH_3DES_.*</sec:include>
					<sec:include>.*_WITH_AES_.*</sec:include>
					<sec:include>.*_WITH_NULL_.*</sec:include>
					<sec:exclude>.*_DH_anon_.*</sec:exclude>
				</sec:cipherSuitesFilter>
					
				<sec:clientAuthentication want="false" required="false" />
			</httpj:tlsServerParameters>
		</httpj:engine>
	</httpj:engine-factory>

As for the client, it is a remote client owned by others so I cannot add
Java options for the client to debug it.  But here is some additional info
that may help:

1.  If I switch my application to run with CXF 3.0.2, everything would work. 
(That might be because the client could downgrade to SSLv3.)
2.  The client can communicate with an IIS server that has SSLv3 disabled
and TLS 1.0 enabled.

Thanks again.



--
View this message in context: http://cxf.547215.n5.nabble.com/CXF-3-0-4-server-cannot-receive-message-from-TLS1-0-client-tp5756863p5756962.html
Sent from the cxf-user mailing list archive at Nabble.com.