users@grizzly.java.net

Re: Disabling sslv3 and tlsv1

From: Will Sargent <will.sargent_at_typesafe.com>
Date: Tue, 2 Dec 2014 11:32:33 -0800

You should check with HowsMySSL:

https://www.howsmyssl.com/s/api.html

Will Sargent
Consultant, Professional Services
Typesafe <http://typesafe.com>, the company behind Play Framework
<http://www.playframework.com>, Akka <http://akka.io> and Scala
<http://www.scala-lang.org/>

On Tue, Dec 2, 2014 at 10:15 AM, Gautam Naha <naha.gautam_at_gmail.com> wrote:

> Hi
>
> Could some body let me know if there is any thing else that needs to be
> done on disabling sslv3 / tlsv1.
>
> I have used sslEngineConfigurator.setEnabledProtocols(new
> String[]{"TLSv1.1","TLSv1.2"}) and tested OK with openssl to check if
> sslv3 and tlsv1 were indeed disabled.
>
> But the issue is when browsers like Firefox try to access the webpage and
> it throws a message like "Connection Interrupted" and cannot show the web
> page. To my understanding the browser should be able to negotiate the
> highest level of tls (i.e tls1.1 and tls1.2) with the server and web page
> should have been displayed. I do not want the user to change any setting in
> browser as this should work automatically.
>
> The only browser that works OK is Chrome.
>
> Please can somebody advice if there is some other stuff that needs to be
> done.
> FYI , Firefox browser is ver 24.0 .
>
> thanks
> Gautam
>