Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux

Question

I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to avoid this. This is issue they have reported :-

" It determined that the remote server supports SSLv3 with at least one CBC cipher suite, indicating that this server is vulnerable. It appears that TLSv1 or newer is supported on the server. However, the Fallback SCSV mechanism is not supported, allowing connections to be "rolled back" to SSLv3 "

SSL Version : SSLv3 High Strength Ciphers (>= 112-bit key) 
EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES-CBC(168) Mac=SHA1 
DHE-RSA-AES128-SHA Kx=DH Au=RSA Enc=AES-CBC(128) Mac=SHA1

I read somewhere in site to check whether SSLv3 is disabled using

openssl s_client -connect example.com:443 -ssl3

I tried with the same command but I always get:

[...]SSL routines:SSL3_READ_BYTES:ssl alert handshake failure

This should mean SSLv3 is disabled, correct? If this is so, then they should not have reported this issue.

How can this issue be replicated, and how can I disable SSLv3 (Apache Tomcat) as requested?

Any help/guidance would be appreciated.

Answer 1

you can check your ssl-setup with either:

• SSLLabs (your site must be online)
• testssl.sh (cli-tool)
• cipherscan (cli-tool)
• ssllyze (cli-tool)

you should have a basic knowledge on how to interpret the results though

for disabling ssl in your tomcat please read (there might be interferences yiwth the JVM used):

• Disabling SSLv3 and SSLv2 in Tomcat and JBoss Web

"When using Tomcat with the JSSE connectors, the SSL protocol to be used can be configured via $TOMCAT_HOME/conf/server.xml. The following example shows how the sslProtocol in an https connector is configured.

Tomcat 5 and 6 (prior to 6.0.38)

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

Tomcat 6 (6.0.38 and later) and 7

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

If the sslEnabledProtocols or sslProtocols attributes are specified, only protocols that are listed and supported by the SSL implementation will be enabled. If not specified, the JVM default is used. The permitted values may be obtained from the JVM documentation for the allowed values for algorithm when creating an SSLContext instance e.g. Oracle Java 6 and Oracle Java 7."