SSL handshake problems with xmlsectool

[Cantor, Scott]

On 10/17/12 4:00 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:
>
>Yes, what was turned off includes TLS. From our httpd.conf:
>
>SSLProtocol All -SSLv2 -TLSv1

Umm, any reason? TLSv1 is a newer SSLv3 in general, and the problems fixed
by TLSv1.1+ affect SSLv3 too.

>Should xmlsectool be trying SSLv3? In other words, is something else to
>blame here?

AFAIK yes, but there lots of things about TLS I don't know.

I believe there's a Java system prop that turns on debugging for SSL in
the JVM. Daniel had me turn that on once to track down the problem with
ldaps name verification, but I don't recall it offhand.

-- Scott