Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is)
(Output from TLS1.0 disabled)
$ openssl s_client -connect localhost:8443 -tls1 CONNECTED(00000003) 139874418423624:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1275:SSL alert number 40 139874418423624:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1505770082 Timeout : 7200 (sec) Verify return code: 0 (ok) ---
The link said if the protocol is enabled, it will say "Connected", else "handshake failure". However, as you can see the messages above, it says both even though I configured Tomcat to use TLS1.2.
My config in the server.xml file:
<Connector port="8443" protocol="HTTP/1.1" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" keystoreFile="/glide/bigdata/bdapi/keys/bdapi_keystore.jks" keystorePass="bdapi123" clientAuth="false" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2"/>
If I allow Tomcat to use TLS1.0, I still see CONNECTED but I also see the certificate info.
(Output from TLS1.0 enabled)
openssl s_client -connect localhost:8443 -tls1 CONNECTED(00000003) <snip snip> <snip snip> (certificate info) verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain <snip snip> <snip snip> (certificate info) --- Server certificate -----BEGIN CERTIFICATE----- <snip snip> <snip snip> (public key) -----END CERTIFICATE----- <snip snip> <snip snip> (certificate info) --- No client certificate CA names sent Server Temp Key: ECDH, secp521r1, 521 bits --- SSL handshake has read 2121 bytes and written 357 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : ECDHE-RSA-AES256-SHA Session-ID: 59C0448146B0A18DE52D99C630C896E12BA9861702AB2582C2AA0658E6458B04 Session-ID-ctx: Master-Key: <some random key> Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1505772673 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) --- read:errno=0
How do I interpret the output from openssl? Did I successfully disable TLS1.0 with the config above or since it says "CONNECTED" in both output, I didn't disable it and I'll fail the security scan again?