I need to make sure that a web app running on Tomcat 6.0.36 with Java 1.8 is only using TLS 1.2

  1. As per documentation, I tried adjusting the Connector section in server.xml: sslProtocol="TLSv1.2" (I even set sslEnabledProtocols, even though it's ignored on this version of Tomcat).

  2. In Configure Tomcat app, I have set the Dhttps.protocols=TLSv1.2 Dhttps.cipherSuites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (and various combinations of these)

  3. In Env Variables, I've set JAVA_OPTS

    • Djdk.tls.client.protocols="TLSv1.2"
    • Dhttps.protocols=TLSv1.2

I have tried all combinations of these (spent days searching the web for solutions), and no luck. Whenever I uncheck "Use TLS 1.0" from the "Advanced\Security" section in IE internet options, it stops working (even the Tomcat Status page is not accessible). I get the error: "This page can't be displayed. Turn on TLS 1.0, TLS 1.1 and TLS 1.2 in Advanced Settings..." This, in my opinion, is a sure sign that TLS1.0 is always (still) used

Any ideas are welcome!

  • Have you verified with nmap --script ssl-enum-ciphers -p 443 or SSL Labs? – bonsaiviking Jun 20 '17 at 16:50
  • No, I haven't - I'm not allowed to install any third party tools. Thanks – mack Jun 20 '17 at 18:41
  • Connector.protocols (but I think not sslProtocol) should work -- but OTOH j8 should default to TLS1.0,1.1,1.2 with no config at all, and without a more accurate test tool than IE it's going to be hard to investigate. The other things you tried -- https.protocols https.ciphersuites jdk.tls.client.protocols -- only apply to (some) clients and are a waste of time for a server. – dave_thompson_085 Jun 21 '17 at 5:27
  • Thanks, Dave. For some reason, "sslProtocols" is not accepted at all. – mack Jun 21 '17 at 13:36
  • See serverfault.com/a/729407/272861 – Anand Bhat Jul 9 '17 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.