SSL Error: alert internal error

[Christopher Peters]

Hey Scott et al,

I just wanted to give an update on this as I've finally resolved it and I
figured people would want to know.

As I understand it, weak encryption methods are the culprit here.
 Apparently, when you use Tomcat 6.0.x (or 5.5, I honestly don't know if
this applies to 7), the JSSE connector on port 8443 (instead of the APR
connector) and you don't specify which "ciphers" to use, the java
implementation of SSL will fail.  I don't know if it's a security
limitation or a misuse of some cipher, but in any case I followed the
directions here:

http://blog.techstacks.com/2008/09/securing-ssl-in-tomcat-part-two.html

And specified a list of ciphers to use, and that cleared the problem up.  I
might yet switch to the APR connector now that I know where the problem
lies and the APR connector is purported to be the better configuration to
use, but in the meantime I have a working system.

Thanks to everyone for your help, and if you have any further comments on
this resolution I'd love to hear them.

Chris


On Tue, Jul 30, 2013 at 9:58 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/30/13 12:31 PM, "Christopher Peters" <cjpeters at uci.edu> wrote:
>
> >and found that I had set clientAuth = "true" instead of "want".  I looked
> >up what that does and apparently it requires a valid cert by supplied
> >before a transaction can be established.  I turned this to want and now
> >it works just fine.
>
> Ah, good point. Didn't think of that.
>
> >To my way of thinking, this means the "alert bad certificate" error isn't
> >saying the cert the server is giving out is bad, but the one it's
> >receiving is bad (or non-existent).  I don't know if that's correct, but
> >I do know this new setting is working out and if someone with expertise
> >cares to give a little more explanation on why I would love to hear it.
>
> I think you're correct.
>
> >Otherwise, I can just move forward now.  I think this is fixed :)
>
> I don't think that's causing your other problems, just explains what we
> saw.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Chris Peters
Middleware Services Developer
Office of Information Technology - NSP
(949) 824-6845
cjpeters at uci.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131024/12c74995/attachment-0001.html