Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
MIME-version: 1.0
Content-transfer-encoding: 8BIT
Content-type: text/plain; charset=utf-8
Subject: Re: [OT] Tomcat 7.0.55/Jre 7u67: SEND TLSv1 ALERT: fatal,
 description = bad_record_mac
Reply-to: Tomcat Users List <users@tomcat.apache.org>
References: 
 <CA+3DT7oVcfh6YMWuF9Pwr5sC4RGXqZe+NRhNFFm3dMK3h22_+g@mail.gmail.com>
 <CA+3DT7o893mcn-omyE7G_FfS19T+uXSWLfRFuaz5LDcbcAQQ-g@mail.gmail.com>
 <55E48B9D.5040102@christopherschultz.net>
 <BY2PR0501MB16855AE932CEBC74235A9932CC340@BY2PR0501MB1685.namprd05.prod.outlook.com>
 <BY2PR0501MB1685DEC32693387EB84EB388CC340@BY2PR0501MB1685.namprd05.prod.outlook.com>
 <561D0A37.6080906@christopherschultz.net>
 <BLUPR0501MB1716B30A08416B66EF006671CC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
 <BLUPR0501MB17166DF9F19E062F281327AFCC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
 <561D636E.7070805@christopherschultz.net>
 <BLUPR0501MB1716430C6AE56129F5B3FCF7CC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
 <CAE3SZN3a+sMx+ZKv58Vm5uL963RGzvQayk1ppHdXwMJMVM0=tQ@mail.gmail.com>
 <CAE3SZN1KJgerquJswcNLBgFMMCq67Crr-Yj=hvoTROnWNVLQtg@mail.gmail.com>
 <BLUPR0501MB1716C0855FC8BCD3F93C0DB7CC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
 <561D72CD.1010608@christopherschultz.net>
To: Tomcat Users List <users@tomcat.apache.org>
From: Christopher Schultz <chris@christopherschultz.net>
Message-id: <561D7694.5010305@christopherschultz.net>
Date: Tue, 13 Oct 2015 17:24:36 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0)
 Gecko/20100101 Thunderbird/38.3.0
In-reply-to: <561D72CD.1010608@christopherschultz.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

All,

On 10/13/15 5:08 PM, Christopher Schultz wrote:
> George and Aurélien,
> 
> On 10/13/15 5:06 PM, George Stanchev wrote:
>> Try the dropbox location in my prev messages. It contains a
>> sample echo server you can use to test. It is a Visual Studio
>> 2013 project. In case you don’t have that, I've uploaded x64
>> executables under SSLServer_executbale.zip. It is pretty much
>> self contained, it has the redist DLLs, the server cert, all...
> 
>> It eliminates the need of IIS as it does the same thing - accept
>>  connection, read payload, upgrade to 2 way ssl...
> 
>> It generates output like this [1]
> 
>> The line " Decrypt error from SCHANNEL, Client ID: 
>> a1cefeb8-bad3-4903-8dbe-fdea347f666e" is emitted when bad record 
>> mac is caught on the server side...
> 
> On 10/13/15 4:55 PM, Aurélien Terrestris wrote:
>> "How do you force Java 8 to use SSLv2Hello?"
> 
>> You can do this when writing your own Java client : calling the 
>> SSLSocketFactory to create an SSLSocket and configure with 
>> setEnabledProtocols (
> 
> https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLSocket.html
#s
>
> 
etEnabledProtocols-java.lang.String:A-
>> )
> 
>> If you have some IIS server on internet which reproduces the 
>> problem, I'll try with JTouch ( jtouch.sourceforge.net ) or write
>> a small client.
> 
> I've got a client already written. I'll post the latest code
> somewhere.

https://wiki.apache.org/tomcat/tools/SSLTest.java
and
https://wiki.apache.org/tomcat/tools/SSLUtils.java

This tool only performs the SSL handshake, so it doesn't do anything
at the HTTP level. It doesn't do client certificates; I'd be happy to
see someone add that capability and update the code on the Wiki.

- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJWHXaUAAoJEBzwKT+lPKRYTgcQAKdzEBtjLyCbkBBlJJObUxm0
dxAhLIFfBkcmo0IquMUJBnCHJ9hfuuhnXDvzLhvvAhfoiG8CkGfcjw79LwcL49iO
+eAuz1bycFvfSoVW+ZEPIXl13n4v+t2hBYfGJJgcYefOBJBfIGLHTazmi53F9vfn
zrnno6wRZkZ+JrFrzSlfMMvWnOE7Uv5ZDKw/8tv85ZTPuIIdIud8Uy0Z5J3HHgYx
t5WBL3JaqLcUihIUUuibSfmw27iyfKPv6OusoVPKc9pKb+uWoLftyE4d4btVTFEV
qDAdmW3XaA/1GHZ3n5szHND+EkdKkiiic7mHRgsN+4F/AH3KVoWs9+Qw9vOhO+da
XgeehuKB1nfnNrhI1n4eEoYC+P162GxVqNKIsKFat38BGEZlCRaAt8UtsfhE0AvO
2gaF1k1vyYcCoXhNYF9WQLatnx1MXeAZMYw3oAZPOusDoqtGElCJfYc1K8iJayEl
bBzYojkzLjFqPfJJ8tvCqBwkngNCw6MgyqVbYSMxDREQtZBa2xYGLHv9bWL0Kp+6
Q5Y3u4uks7OCGH+Usfvq82ZGnp6mnneA2jgAd0KWSJDjKcaNUWQVOirPVTFnpNmh
+dUZUM/gR1CIQHoiu8i8NH9qn2jtBtDvnYRWswzJlt9tOpaxPQWwdBL86gj4cWHp
aGwTUveYwOgLokoEUXHO
=Iha7
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org