<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Shib Community,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Recently, we have upgraded one of our IdP server to IdP v4.0.1. The server is deployed with Tomcat 9.0.40 and OpenJDK 11 on CentOS 7.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We find a problem that the X509 certificate-based authentication stops working in Safari. We use a tomcat connector to handle the X509 certificate-based authentication. </div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Here's the configuration for the tomcat connector.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<Connector port="664"
<div> protocol="org.apache.coyote.http11.Http11NioProtocol"</div>
<div> maxThreads="150" SSLEnabled="true" scheme="https" secure="true"</div>
<div> defaultSSLHostConfigName="idpz.utorauth.utoronto.ca"></div>
<div> <SSLHostConfig</div>
<div> hostName="idpz.utorauth.utoronto.ca"</div>
<div> truststoreFile="/local/etc/shibboleth/credentials/truststore"</div>
<div> truststorePassword="****"</div>
<div> truststoreType="JKS"</div>
<div> certificateVerification="required"</div>
<div> sslProtocol="TLSv1.2"</div>
<div> protocols="TLSv1.2"><br>
</div>
<div> <Certificate certificateFile="/etc/pki/tls/links/idpz.utorauth.utoronto.ca/cert"</div>
<div> certificateChainFile="/etc/pki/tls/links/idpz.utorauth.utoronto.ca/chain"</div>
<div> certificateKeyFile="/etc/pki/tls/links/idpz.utorauth.utoronto.ca/key"/></div>
<div> </SSLHostConfig></div>
<div> </Connector></div>
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
When I connect to this port for certificate-based authentication in Safari. Safari sends ClientHello message with TLSv1 protocol and that causes the SSL handshake with the server to fail. In other browsers, like Chrome, Microsoft Edge, Firefox, there's no such
issue, the ClientHello message uses TLSv1.2 protocol and the certificate-based authentication could complete.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does anyone know if there are any Tomcat/JVM/Shibboleth parameters I need to set up so that Safari can use TLSv1.2 to talk to the server?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0; margin-bottom:0"><span id="ms-rterangepaste-start"></span></p>
<pre class="moz-signature" cols="72">Zunan Dong</pre>
<pre class="moz-signature" cols="72">Authentication Systems Specialist</pre>
<pre class="moz-signature" cols="72">Information Security
Information Technology Service
University of Toronto
Email: zunan.dong@utoronto.ca</pre>
<span id="ms-rterangepaste-end"></span><br>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
</div>
</div>
</div>
</div>
</body>
</html>