Page Comparison

The transport level security protocol of the Tomcat server is configured in the <PRODUCT_HOME>/conf/tomcat/catalina-server.xml file. Note that the ssLprotocol attribute is set to "TLS" by default. 
See the following topics for detailed configuration options:

Disable

...

SSL 

Follow the steps given below to disable SSL 3.0 support on WSO2 Carbon 4.3.0 based servers.

1. Open the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file. 
2. Make a backup of the catalina-server.xml file and stop the Carbon server.
3. Find the Connector configuration corresponding to TLS (usually, this connector has the port set to 9443 and the sslProtocol as TLS).

   • If you are using JDK 1.6, remove the sslProtocol="TLS" attribute from the configuration and replace it with sslEnabledProtocols="TLSv1" as shown below.

     Code Block
     <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="9443" bindOnInit="false" sslEnabledProtocols="TLSv1"

   •  If you are using JDK 1.7, remove the sslProtocol="TLS" attribute from the above configuration and replace it with sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" as shown below.

     Code Block
     <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="9443" bindOnInit="false" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"

4. Start the server.

   Note
   In some Carbon products, such as WSO2 ESB and WSO2 API Manager, pass-thru transports are enabled. Therefore, to disable SSL version 3 in such products, the axis2.xml file stored in the <PRODUCT_HOME>/repository/conf/axis2/ directory should also be configured.

To test if SSL version 3 is disabled:

1. Download TestSSLServer.jar from here.

2. Execute the following command to test the transport:

   Code Block
   java -jar TestSSLServer.jar localhost 9443

3. The output of the command before and after disabling SSL version 3 is shown below.
   Before SSL version 3 is disabled:

   Code Block

   Supported versions: SSLv3 TLSv1.0 Deflate compression: no Supported cipher suites (ORDER IS NOT SIGNIFICANT): SSLv3 RSA_EXPORT_WITH_RC4_40_MD5 RSA_WITH_RC4_128_MD5 RSA_WITH_RC4_128_SHA RSA_EXPORT_WITH_DES40_CBC_SHA RSA_WITH_DES_CBC_SHA RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA_EXPORT_WITH_DES40_CBC_SHA DHE_RSA_WITH_DES_CBC_SHA DHE_RSA_WITH_3DES_EDE_CBC_SHA RSA_WITH_AES_128_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA RSA_WITH_AES_256_CBC_SHA DHE_RSA_WITH_AES_256_CBC_SHA (TLSv1.0: idem)

   After SSL version 3 is disabled:

   Code Block

   Supported versions: TLSv1.0 Deflate compression: no Supported cipher suites (ORDER IS NOT SIGNIFICANT): TLSv1.0 RSA_EXPORT_WITH_RC4_40_MD5 RSA_WITH_RC4_128_MD5 RSA_WITH_RC4_128_SHA RSA_EXPORT_WITH_DES40_CBC_SHA RSA_WITH_DES_CBC_SHA RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA_EXPORT_WITH_DES40_CBC_SHA DHE_RSA_WITH_DES_CBC_SHA DHE_RSA_WITH_3DES_EDE_CBC_SHA RSA_WITH_AES_128_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA RSA_WITH_AES_256_CBC_SHA DHE_RSA_WITH_AES_256_CBC_SHA

...

Firefox 39.0 onwards does not allow to access Web sites that support DHE with keys less than 1023 bits (not just DHE_EXPORT). 768/1024 bits are considered to be too small and vulnerable to attacks if the hacker has enough computing resources.