XMLSecTool and TLSV1.1/1.2

[Ian Young]

On 30 Jan 2014, at 22:51, Wessel, Keith <kwessel at illinois.edu> wrote:

> Many of you may remember a while back that I had an issue with xmlsectool grabbing metadata from our systems since our security folks have our sysadmins disable TLSv1.0. RHEL 6.5 recently came out and included OpenSSL 1.0.1E which has support for TLSv1.1 and 1.2. I verified with OpenSSL that it's enabled on our web servers by default as our sysadmins told me it was by using the -tlsv1_1 and -tlsv1_2 options.
> 
> But I still get an error from xmlsectool when trying to fetch metadata from these servers: javax.net.ssl.SSLException: Received fatal alert: bad_record_mac
> 
> I'm running xmlsectool 1.2.0 and the Sun JDK 6.0.45. I would assume that combination is modern enough to support TLS v1.1/1.2.

No, it's not. The JDK does not use OpenSSL, so the update to OpenSSL in RHEL/CentOS 6.5 doesn't benefit it.

I believe that TLS 1.1/1.2 support arrived in Java 7 in both the Sun and OpenJDK flavours. You can install that side-by-side on a RHEL/CentOS 6.5 system, so I'd recommend giving that a try and letting us know what you find out.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5943 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20140131/2ec50753/attachment-0001.bin