SSL handshake problems with xmlsectool

[Cantor, Scott]

On 10/17/12 4:52 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:
>
>A very good question about why we disabled TLSv1, and I asked. The
>security guy behind it has left, but the one who I talked to recalls that
>too many clients out there don't yet support TLSv1.1 and v1.2. So, the
>safest option, as tey saw it, was to only allow SSLv3. (I'm just
>repeating what I was told, so I hope that actually makes some sense
>beyond the abstract level to which it makes sense to me.)

It isn't my understanding that SSLv3 is immune to the issues affecting
TLSv1.

>As for debugging, I think you were referring to -Djavax.net.debug=ssl
>which I enabled but learned little from. It made it through the Hello
>section of the negociation and seems to have settled on SSLv3, but then
>the following rather unhelpful exchange occurs. Thoughts on why this is
>failing?

No, that's well below any layer I deal with. Nothing to do with xmlsectool
at all really, it's a Java issue. But I don't think it's advisable to
disable TLSv1 unless you're also disabling SSLv3.

-- Scott