<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/19/15 12:37 PM, Brent Putman
wrote:<br>
</div>
<blockquote cite="mid:56251C58.5090002@georgetown.edu" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<br>
I was going to at least see if I could just reproduce the problem,
using an SP + new enough OpenSSL for EC support.<br>
</blockquote>
<br>
I manged to get an SP on a RHEL 6.6 machine with openssl 1.0.1e and
do some basic testing.<br>
<br>
In short, I was able to always reproduce Jarno's exact error. I
couldn't get it to work at all.<br>
<br>
I also upgraded to Orace JDK 1.8.0_60, and tried with and without
unlimited strength policy files.<br>
<br>
Thinking that it might be an issue with what named curves are
supported in Java, I tried all 3 supported by this version of
openssl: secp384r1, secp521r1, prime256v1. (I did also
discover/relearn that the SunEC provider only supports named curves,
not explicit parameters, for the keys/certs ).<br>
<br>
Also tried both ecdsa-sha1 and ecdsa-sha256 signature algorithms. No
luck.<br>
<br>
I tried disabling the SunEC provider and installing BC as a security
provider, but I couldn't get my Jetty to work that way. It horks up
something with the TLS layer in Jetty. Probably need to tweak
something there, but sort of ran out of time for now. So wasn't
able to determine yet if BC produces a different result.<br>
<br>
So yeah, disappointing, I thought this "just worked". Definitely
something we need to look at in more depth. I guess the issue could
be on either end at this point.<br>
<br>
I probably will not be able to spend any more time on this for at
least a couple of weeks due to trying to get the release out.<br>
<br>
<br>
</body>
</html>