I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to avoid this. This is issue they have reported :-
" It determined that the remote server supports SSLv3 with at least one CBC cipher suite, indicating that this server is vulnerable. It appears that TLSv1 or newer is supported on the server. However, the Fallback SCSV mechanism is not supported, allowing connections to be "rolled back" to SSLv3 "
SSL Version : SSLv3 High Strength Ciphers (>= 112-bit key) EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES-CBC(168) Mac=SHA1 DHE-RSA-AES128-SHA Kx=DH Au=RSA Enc=AES-CBC(128) Mac=SHA1
I read somewhere in site to check whether SSLv3 is disabled using
openssl s_client -connect example.com:443 -ssl3
I tried with the same command but I always get:
[...]SSL routines:SSL3_READ_BYTES:ssl alert handshake failure
This should mean SSLv3 is disabled, correct? If this is so, then they should not have reported this issue.
How can this issue be replicated, and how can I disable SSLv3 (Apache Tomcat) as requested?
Any help/guidance would be appreciated.