All Questions
13 questions
1
vote
0
answers
2k
views
Disabling weak cipher suites in Tomcat does not work as expected
I have to get rid of so called "weak security" in a Tomcat application.
A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
- 161
1
vote
1
answer
398
views
Encryption with Tomcat & Nginx reverse proxy
I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind:
...
- 11
3
votes
1
answer
860
views
Should I regenerate SSL certificates after upgrading Openssl
As you may already know old Openssl versions were vulnerable(OpenSSL 1.0.1 through 1.0.1f (inclusive)) by the HeartBleed vulnerability. Currently our server is running Tomcat7 which is built in a ...
- 153
1
vote
2
answers
2k
views
Using certificate on same server but different port for https
I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I ...
- 11
3
votes
1
answer
4k
views
Does the CA have to be same for mutual authentication?
I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall.
The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate).
The ...
17
votes
5
answers
86k
views
Using the openssl command, how can I tell if it's using TLS 1.0?
Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is)
(Output from TLS1....
- 273
1
vote
0
answers
7k
views
Only Enable TLSv1.2 on Tomcat 6.0.36
I need to make sure that a web app running on Tomcat 6.0.36 with Java 1.8 is only using TLS 1.2
As per documentation, I tried adjusting the Connector section in server.xml:
sslProtocol="TLSv1.2" (I ...
- 11
1
vote
0
answers
79
views
TLS: Using different signature algorithms for ca and server certificate [duplicate]
I've the following scenario:
Root-CA: key algorithm is RSA-2048 and it's self-signed (Sha256WithRSA)
Server-Cert: key algorithm is ECDSA, based on secp384r1 and it's signed by Root-CA with ...
- 11
0
votes
2
answers
1k
views
SSL certificate for server authentication
to clear my understandings:
I create self signed certificate first
keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks
the firstname of the self sign has to be my domain name?
...
5
votes
1
answer
2k
views
Does TrustManager PKIX (or RFC 3280/X.509) really check the expiration date of a client's certificate?
It was noticed that the default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check the expiration date of a client's ...
- 153
1
vote
2
answers
4k
views
What algorithm should I use to avoid the error "ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY"?
I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error:
...
- 11
3
votes
1
answer
12k
views
Creating an TLS certificate using keytool with SHA-256
I want to create a TLS certificate for my personal tomcat8 webserver on a Debian ARM server. I've done this before, using the following command:
/usr/bin/keytool -genkey -alias tomcat -keyalg RSA -...
- 7,569
9
votes
3
answers
5k
views
Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?
Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat?
I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
- 193