XMLSecTool and TLSV1.1/1.2

[Wessel, Keith]

Following up on the idea of upgrading to Java 7 on the boxes running xmlsectool to grab and publish metadata and to eventually upgrade our IDPs as well, I got JDK 7U51 and put it on the metadata signing test server. Oddly, I got the same identical error as before, fatal alert: bad_record_mac.

Stupid question but one that I haven't found any info on elsewhere: is TLS v1.1 and 1.2 enabled by default in Java 7? I see nothing in java.security to indicate it's turned off, but I imagine there could be a switch elsewhere.

Keith


-----Original Message-----
From: Wessel, Keith 
Sent: Friday, January 31, 2014 1:21 PM
To: Shib Users
Subject: RE: XMLSecTool and TLSV1.1/1.2

Thanks, Scott. But what it comes down to, if we're using Java 6 on our IDP, is that it won't be able to grab metadata from https URLs if the server hosting the metadata has TLS v1.0 disabled, correct?

The SSL hostname validation exception threw me since I was expecting a handshake exception. So, just making sure my above statement is true to our best guess before I put this little task on hold until Java 7 goes onto our IDP.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, January 31, 2014 12:27 PM
To: Shib Users
Subject: Re: XMLSecTool and TLSV1.1/1.2

On 1/31/14, 12:52 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>
>I can certainly upgrade to Java 7 to get xmlsectool using the new 
>protocols. But that won't do me much good if the IDP can't consume 
>metadata from the SSL-enabled webserver, correct?

The IdP is just using Java's SSL code, AFAIK. Not directly, there are some libraries there, but the underlying socket factory is just the regular one.

> Currently, with TLSv1.1 and 1.2 enabled on our test server where we 
>distribute signed metadata over https, our IDP on a different server is 
>attempting to retrieve that metadata and reporting:
>
>javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname 
>validation for name: null

I don't think that's a TLS versioning issue unless something is just throwing a spurious exception.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net