0

I have an Application in Tomcat 8.5.8. I have Apache 2.4 webserver in front of Tomcat server. I have configured Apache with ssl TLS1.2 and ciphursuite : SSLCipherSuite "HIGH:!aNULL:!MD5:!3DES:!CAMELLIA:!AES128".

Now when I am trying to make httpsURLConnection call to the servlet in my application, it is throwing following exception:

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

I am thinking that ideally httpsurlconnection code should not particularly enable any ciphursuites. Please give me the direction.

I am using JDK 1.8.

Abhishek Aryan
  • 19,936
  • 8
  • 46
  • 65
Harish Alwala
  • 142
  • 1
  • 1
  • 9
  • 1
    Possible duplicate of [Received fatal alert: handshake\_failure through SSLHandshakeException](http://stackoverflow.com/questions/6353849/received-fatal-alert-handshake-failure-through-sslhandshakeexception) – Akshay Feb 23 '17 at 06:12
  • In particular see the answers by heez and Simon Yu, since your Apache config allows only ciphersuites using AES-256 and Oracle Java by default does not support 256-bit encryption (although OpenJDK does, at least in the builds I've tried). – dave_thompson_085 Feb 23 '17 at 06:39

1 Answers1

0

I replaced above Apache configuration entry

SSLCipherSuite "HIGH:!aNULL:!MD5:!3DES:!CAMELLIA:!AES128"

with following

SSLCipherSuite "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:kEDH+AESGCM:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:AES256:AES128:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"

and it worked fine. Absolutely no change in the client code.

Harish Alwala
  • 142
  • 1
  • 1
  • 9