Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
MIME-Version: 1.0
In-Reply-To: <561F1088.6060205@christopherschultz.net>
References: 
 <CA+3DT7oVcfh6YMWuF9Pwr5sC4RGXqZe+NRhNFFm3dMK3h22_+g@mail.gmail.com>
	<BLUPR0501MB1716B30A08416B66EF006671CC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
	<BLUPR0501MB17166DF9F19E062F281327AFCC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
	<561D636E.7070805@christopherschultz.net>
	<BLUPR0501MB1716430C6AE56129F5B3FCF7CC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
	<CAE3SZN3a+sMx+ZKv58Vm5uL963RGzvQayk1ppHdXwMJMVM0=tQ@mail.gmail.com>
	<CAE3SZN1KJgerquJswcNLBgFMMCq67Crr-Yj=hvoTROnWNVLQtg@mail.gmail.com>
	<CAE3SZN29hgCAx_etPPH=A_DJTy=8974ayQRyzKPxMFGHAqJ_XA@mail.gmail.com>
	<BLUPR0501MB1716E543506FFE7ABEE81765CC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
	<CAE3SZN0VYrc8awaGbjhVL48KSdUQJmajNAs-xU-3eEXSPmebZw@mail.gmail.com>
	<BLUPR0501MB171627A4916D0FB3AE7C356FCC300@BLUPR0501MB1716.namprd05.prod.outlook.com>
	<BLUPR0501MB17162DC5B03C8F4F3244FE54CC3F0@BLUPR0501MB1716.namprd05.prod.outlook.com>
	<CAE3SZN0kapk6bC+kbShY03o5bDdsgbwg88O4yxBzSGNE3AM=tw@mail.gmail.com>
	<561F1088.6060205@christopherschultz.net>
Date: Thu, 15 Oct 2015 15:43:26 +0200
Message-ID: 
 <CAE3SZN3T6U+J=MnxraFkE0Qzij=nYT7k+8Pjk6aDVF2P-HGb9A@mail.gmail.com>
Subject: Re: [OT] Tomcat 7.0.55/Jre 7u67: SEND TLSv1 ALERT: fatal, description
 = bad_record_mac
From: =?UTF-8?Q?Aur=C3=A9lien_Terrestris?= <aterrestris@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=001a113d329e14cc00052224dd91

--001a113d329e14cc00052224dd91
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

George,

I'm not sure we can find any solution, but can we have a look at a pcap
capture ?
Esmond Pitt was posting sometimes, that would be a challenge for him.

2015-10-15 4:33 GMT+02:00 Christopher Schultz <chris@christopherschultz.net=
>
:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Aur=C3=A9lien,
>
> On 10/14/15 5:59 PM, Aur=C3=A9lien Terrestris wrote:
> > Still no solutions, I suppose..
> >
> > Did you enable the SSLv2 Hello as suggested by Chris, and what's
> > the result ? I tested a small client with Java 8, by adding
> > -Djdk.tls.client.protocols=3D"SSLv2Hello,TLSv1.2" at the command
> > line, and I get my SSLv2 Hello.
>
> It looks like if you add SSLv2Hello to the list of protocols you'll
> accept, you'll get an SSLv2Hello in there (abridged output):
>
> Allow unsafe renegotiation: false
> Allow legacy hello messages: true
> Is initial handshake: true
> Is secure renegotiation: false
> ...
> main, WRITE: TLSv1.2 Handshake, length =3D 221
> main, WRITE: SSLv2 client hello message, length =3D 140
> main, READ: TLSv1.2 Handshake, length =3D 81
> main, READ: TLSv1.2 Handshake, length =3D 2779
> main, READ: TLSv1.2 Handshake, length =3D 589
> main, READ: TLSv1.2 Handshake, length =3D 4
> main, WRITE: TLSv1.2 Handshake, length =3D 70
> main, WRITE: TLSv1.2 Change Cipher Spec, length =3D 1
> main, WRITE: TLSv1.2 Handshake, length =3D 40
> main, READ: TLSv1.2 Change Cipher Spec, length =3D 1
> main, READ: TLSv1.2 Handshake, length =3D 40
>
> You just have to use a custom SSLSocketFactory that sets the protocols
> you want to enable on the (client) socket. If one of the protocols you
> use is "SSLv2Hello".
>
> Oddly enough, when *not* specifying SSLv2Hello, you'll get this
> (abridged output):
>
> Allow unsafe renegotiation: false
> Allow legacy hello messages: true
> Is initial handshake: true
> Is secure renegotiation: false
> ...
> main, WRITE: TLSv1.2 Handshake, length =3D 221
> main, READ: TLSv1.2 Handshake, length =3D 89
> main, READ: TLSv1.2 Handshake, length =3D 2779
> main, READ: TLSv1.2 Handshake, length =3D 589
> main, READ: TLSv1.2 Handshake, length =3D 4
> main, WRITE: TLSv1.2 Handshake, length =3D 70
> main, WRITE: TLSv1.2 Change Cipher Spec, length =3D 1
> main, WRITE: TLSv1.2 Handshake, length =3D 40
> main, READ: TLSv1.2 Change Cipher Spec, length =3D 1
> main, READ: TLSv1.2 Handshake, length =3D 40
>
> When the SSLv2Hello "protocol" isn't enabled, you don't get the "main,
> WRITE" and "main, READ"
>
> Note that I'm not trying anything with a client certificate, here. I
> hope that helps somewhat.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
>
> iQIcBAEBCAAGBQJWHxCIAAoJEBzwKT+lPKRYCNQQAMJx3cHj3Rl8ieX+2cANmXfW
> fHr0MPkHNIcbzpX5WWJaEqfhnYqQTk9TiY7rKxwjo3OtJtEG1bkm9tqeq4pzHJcX
> oQ03/wMOKrNqqGoILcpdWgRpc0jylsx1GouJ2qmmCNvZO1fBdBhtAE49dvg4Hd+c
> uOzet5CizkTIfbu/i2Rb/szC9T/mopvicOsoS7oe1EE7sJZKL4BU3ayun5KvFXvr
> 0KbDRU0Btp3M0YcPP4R2MtExYROW9pwwb5UYJdmK8ZxHAsmhJsG8DzDQnywFEx3+
> cm2e0W5v5FMAAh3PBNqfl5VN/8uIlHkeLtCjDU0JCMCfguwTQbitPpyhatnRlE7z
> K8FfdZUC2zBprX1HnJl5aT02u3STzRsyL5DWlVAKPC/OAUEYFO26Ira1K86ACpww
> O7t6phwHfXdGIkT/GdT9i2DgGippj6/mAhgq6XUsAkVr9usK33pNP8q/jf/ORwq/
> Njf4d4vjRNw3W7UZ0w0NCgZ7dKdepC/x2sT6zugQugiLNQ+gHGQWfcOhrQsRsj8f
> qHGU1E+94g5oQCqb14KWoZv8bAA2WYAqgUK3DK2icsiCEFqWd6Yb6gYcvIGsbV9t
> g+Mtxfm5qjncCwHeyONd3uBWTjakZb7fIvk4di0pZcnZB7HFYx7/r0ndS+IRzUVS
> LJxWiHhKQZ32QvVKtBxe
> =3DzKZ4
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

--001a113d329e14cc00052224dd91--