Page Comparison

...

1. Open the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file. 
2. Take a backup of the catalina-server.xml file and stop the Carbon server.

3. Find the Connector configuration corresponding to TLS (usually, this connector has the port set to 9443 and the sslProtocol as TLS).

   If you are using JDK 1.6, remove

   Remove the sslProtocol="TLS" attribute

   from the configuration Code Block<Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="9443" bindOnInit="false"

   and replace it with 

   sslEnabledProtocols="TLSv1" as shown below.

   sslEnabledProtocols="TLSv1

   " If you are using JDK 1.7

   ,

   remove the sslProtocol="TLS" attribute from the above configuration and replace it with sslEnabledProtocols="

   TLSv1

   ,TLSv1

   .1,TLSv1.2" as shown below.

   Code Block
   <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="9443" bindOnInit="false" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"

4. Start the server.

To test if SSL version 3 is disabled:

1. Download TestSSLServer.jar from here.

2. Execute the following command to test the transport:

   Code Block
   java -jar TestSSLServer.jar localhost 9443

3. The output of the command before and after command after disabling SSL version 3 is shown below.
   Before SSL version 3 is disabled:

   Code BlockSupported versions: SSLv3 TLSv1.0 Deflate compression: no Supported cipher suites (ORDER IS NOT SIGNIFICANT): SSLv3 RSA_EXPORT_WITH_RC4_40_MD5 RSA_WITH_RC4_128_MD5 RSA_WITH_RC4_128_SHA RSA_EXPORT_WITH_DES40_CBC_SHA RSA_WITH_DES_CBC_SHA RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA_EXPORT_WITH_DES40_CBC_SHA DHE_RSA_WITH_DES_CBC_SHA DHE_RSA_WITH_3DES_EDE_CBC_SHA RSA_WITH_AES_128_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA RSA_WITH_AES_256_CBC_SHA DHE_RSA_WITH_AES_256_CBC_SHA (TLSv1

   .

   0: idem)

   
   
   After SSL version 3 is disabled:

   Code Block

   Supported versions: TLSv1.0 Deflate compression: no Supported cipher suites (ORDER IS NOT SIGNIFICANT): TLSv1.0 RSA_EXPORT_WITH_RC4_40_MD5 RSA_WITH_RC4_128_MD5 RSA_WITH_RC4_128_SHA RSA_EXPORT_WITH_DES40_CBC_SHA RSA_WITH_DES_CBC_SHA RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA_EXPORT_WITH_DES40_CBC_SHA DHE_RSA_WITH_DES_CBC_SHA DHE_RSA_WITH_3DES_EDE_CBC_SHA RSA_WITH_AES_128_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA RSA_WITH_AES_256_CBC_SHA DHE_RSA_WITH_AES_256_CBC_SHA

...