SSL handshake problems with xmlsectool

[Wessel, Keith William]

Scott,

I agree with your statement about not bothering disabling TLSv1 unless you're taking SSLv3 with it. And once you do that, you don't have much left in terms of quality security for client connections. Unfortunately, to make that argument with our security folks, I'm going to need some good facts to back it up. I'll look into it, though.

So, when you mentioned a debug option, you meant in xmlsectool? If there's another debug option out there, or someone who can interpret my Java debug trace to see what's going wrong, I'd appreciate the input. In the meantime, I'm going to at least temporarily enable TLSv1 to see if that solves the problem. I expect it will.

Worst case, I wget the metadata and operate on it locally. Wget seems to have no problem with the protocol negocations.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, October 17, 2012 3:59 PM
To: Shib Users
Subject: Re: SSL handshake problems with xmlsectool

On 10/17/12 4:52 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:
>
>A very good question about why we disabled TLSv1, and I asked. The 
>security guy behind it has left, but the one who I talked to recalls 
>that too many clients out there don't yet support TLSv1.1 and v1.2. So, 
>the safest option, as tey saw it, was to only allow SSLv3. (I'm just 
>repeating what I was told, so I hope that actually makes some sense 
>beyond the abstract level to which it makes sense to me.)

It isn't my understanding that SSLv3 is immune to the issues affecting TLSv1.

>As for debugging, I think you were referring to -Djavax.net.debug=ssl 
>which I enabled but learned little from. It made it through the Hello 
>section of the negociation and seems to have settled on SSLv3, but then 
>the following rather unhelpful exchange occurs. Thoughts on why this is 
>failing?

No, that's well below any layer I deal with. Nothing to do with xmlsectool at all really, it's a Java issue. But I don't think it's advisable to disable TLSv1 unless you're also disabling SSLv3.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net