XMLSecTool and TLSV1.1/1.2

[Wessel, Keith]

Hi, all,

Many of you may remember a while back that I had an issue with xmlsectool grabbing metadata from our systems since our security folks have our sysadmins disable TLSv1.0. RHEL 6.5 recently came out and included OpenSSL 1.0.1E which has support for TLSv1.1 and 1.2. I verified with OpenSSL that it's enabled on our web servers by default as our sysadmins told me it was by using the -tlsv1_1 and -tlsv1_2 options.

But I still get an error from xmlsectool when trying to fetch metadata from these servers: javax.net.ssl.SSLException: Received fatal alert: bad_record_mac

I'm running xmlsectool 1.2.0 and the Sun JDK 6.0.45. I would assume that combination is modern enough to support TLS v1.1/1.2. Can anyone offer any suggestions on what else to try to fix this error?

Thanks,
Keith