<div dir="ltr">SSLv3 is disabled in tomcat 6.0.16 by replacing <div><span style="font-size:13px"> sslProtocol="TLS" </span><br style="font-size:13px"><span style="font-size:13px"> sslEnabledProtocols="TLSv1.</span><span style="font-size:13px">1,TLSv1.2"</span><br></div><div><span style="font-size:13px">with</span></div><div><span style="font-size:13px"> </span> sslProtocols="TLSv1,TLSv1.1,TLSv1.2"</div><div>in the Connector statement in tomcat's ~/conf/server.xml</div><div>(though, as Chris Bongarats noted, support for 1.1 and 1.2 depends on JDK later than my 1.6).</div><div><br></div><div>Thanks for the pointers.</div><div><br></div><div>David Bantz</div>
</div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 12, 2014 at 12:24 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 12/12/14, 8:32 PM, "IAM David Bantz" <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br>
<br>
<br>
<br>
>My IdP is running in tomcat 6.0.16-0 [updated SSL libraries<br>
>mod_ssl.x86_64 1:2.2.3-91.el5, openssl.i686 0.9.8e-31.el5_11,<br>
>openssl.x86_64 0.9.8e-31.el5_11 and java-sun.x86_64<br>
>1.6.0.45-1jpp.1.el5_9 ].<br>
<br>
</span>OpenSSL isn't relevant, and Java 6 is EOL. So you'd start by moving to<br>
Java 7.<br>
<span class=""><br>
>Removing older ciphers this way is effective (they don't show up in SSL<br>
>Labs test), but SSL Labs test still indicates support for SSL 3 and not<br>
>TLS 1.2 (nor 1.1 for that matter).<br>
<br>
</span>I would ask Tomcat's list how to disable SSLv3 for certain if that isn't<br>
doing it.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>