XMLSecTool and TLSV1.1/1.2

[Wessel, Keith]

Thanks, Ian and Scott.

Sorry to confuse matters. When I was referring to OpenSSL, I was talking about Apache now being able to support TLSv1.1/1.2. Before that wasn't an option, so whether Java could do it was moot since the web server couldn't.

I can certainly upgrade to Java 7 to get xmlsectool using the new protocols. But that won't do me much good if the IDP can't consume metadata from the SSL-enabled webserver, correct? Currently, with TLSv1.1 and 1.2 enabled on our test server where we distribute signed metadata over https, our IDP on a different server is attempting to retrieve that metadata and reporting:

javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname validation for name: null

I don't see an SSL handshake exception, but I'm assuming that the Java 6-based IDP is showing the problem with the failed hostname validation instead. Does that theory seem right?

If so, I think I'm going to hold off on this until our IDPs are on Java 7, probably after the release of IDP V3.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Ian Young
Sent: Friday, January 31, 2014 2:13 AM
To: Shib Users
Subject: Re: XMLSecTool and TLSV1.1/1.2


On 30 Jan 2014, at 22:51, Wessel, Keith <kwessel at illinois.edu> wrote:

> Many of you may remember a while back that I had an issue with xmlsectool grabbing metadata from our systems since our security folks have our sysadmins disable TLSv1.0. RHEL 6.5 recently came out and included OpenSSL 1.0.1E which has support for TLSv1.1 and 1.2. I verified with OpenSSL that it's enabled on our web servers by default as our sysadmins told me it was by using the -tlsv1_1 and -tlsv1_2 options.
> 
> But I still get an error from xmlsectool when trying to fetch metadata from these servers: javax.net.ssl.SSLException: Received fatal alert: bad_record_mac
> 
> I'm running xmlsectool 1.2.0 and the Sun JDK 6.0.45. I would assume that combination is modern enough to support TLS v1.1/1.2.

No, it's not. The JDK does not use OpenSSL, so the update to OpenSSL in RHEL/CentOS 6.5 doesn't benefit it.

I believe that TLS 1.1/1.2 support arrived in Java 7 in both the Sun and OpenJDK flavours. You can install that side-by-side on a RHEL/CentOS 6.5 system, so I'd recommend giving that a try and letting us know what you find out.

	-- Ian