Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Message-ID: <59D53A37.1010902@touchtonecorp.com>
Date: Wed, 04 Oct 2017 12:44:55 -0700
From: "James H. H. Lampert" <jamesl@touchtonecorp.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>,
 HTTPAPI and FTPAPI Projects <ftpapi@lists.scottklement.com>
Subject: Re: Problem: (GSKit) No compatible cipher suite available between
 SSL end points.
References: <59D406BB.40308@touchtonecorp.com> <723f12a7-b302-207a-e594-c3e2bd9f098d@christopherschultz.net> <59D51228.3050704@touchtonecorp.com> <ddb67266-6ce2-41a9-8fd3-04a1db71d5c8@christopherschultz.net> <59D5333E.7060802@touchtonecorp.com> <56663fb1-e7ef-9ea5-034b-f1e1a3975bb9@christopherschultz.net>
In-Reply-To: <56663fb1-e7ef-9ea5-034b-f1e1a3975bb9@christopherschultz.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
archived-at: Wed, 04 Oct 2017 19:45:03 -0000

On 10/4/17, 12:26 PM, Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> James,
. . .
> Okay so you are in no way interfering with the defaults. That means
> you'll get (depending upon your exact versions of various things) a
> Tomcat which supports TLSv1 or later, and most of the cipher suites
> that are shown as "default" above.
>
> Your choice of TLS certificate may affect some of the things that you
> can do, but I see that you've got an RSA certificate from the output
> from SSLLabs, so you shouldn't have any problems with a DSS
> certificate or anything like that. (Use of DSS certs these days is
> fairly rare).
. . .
> Strange. I would have expected Tomcat to enable more cipher suites
> with a default configuration given the SSLInfo output above.
>
> Are you sure you are using the same Java version with Tomcat as you
> did to run those commands above?

Dear Mr. Schultz:
It sure looks like the same Java version. Here is what the manager returns:
> Apache Tomcat/8.5.14 (Debian) 1.7.0_151-b01 Oracle Corporation Linux 	3.16.0-4-amd64 	amd64

It would definitely be helpful if the OS/400 names of the cipher suites 
more precisely matched the Java names. To recap, the QSSLCSL system 
value on the AS/400 shows (using the OS/400 naming conventions)
> *RSA_AES_128_CBC_SHA
> *RSA_RC4_128_SHA
> *RSA_RC4_128_MD5
> *RSA_AES_256_CBC_SHA
> *RSA_3DES_EDE_CBC_SHA
> *RSA_DES_CBC_SHA
> *RSA_EXPORT_RC4_40_MD5
> *RSA_EXPORT_RC2_CBC_40_MD5
> *RSA_NULL_SHA
> *RSA_NULL_MD5

--
JHHL

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org