diff --git a/webapps/docs/security-howto.xml b/webapps/docs/security-howto.xml index d1979a6..fa80bb6 100644 --- a/webapps/docs/security-howto.xml +++ b/webapps/docs/security-howto.xml @@ -269,7 +269,27 @@ SSL connections. By default, the default ciphers for the JVM will be used. This usually means that the weak export grade ciphers will be included in the list of available ciphers. Secure environments will normally want to - configure a more limited set of ciphers.

+ configure a more limited set of ciphers. This attribute accepts the + + OpenSSL syntax for including/excluding cipher suites. + As of 2014-11-19, with standalone Tomcat 8 and Java 8, Forward Secrecy + can be achieved on the + + Qualys SSL/TLS test by specifying only TLS protocols using + the sslEnabledProtocols attribute (further below) with the following + ciphers: + ciphers="ALL:!aNULL:!eNULL:!EXPORT:!LOW:!MEDIUM:!3DES:
+ !TLS_RSA_WITH_AES_128_CBC_SHA256:!TLS_RSA_WITH_AES_128_CBC_SHA:
+ !TLS_RSA_WITH_AES_128_GCM_SHA256:@STRENGTH" Tomcat does + not "specify" a sort order, but it does seem to present the ciphers in + order because some clients (nmap) choose different protocols when + @STRENGTH is used.

+ +

The sslEnabledProtocols attribute determines which + versions of the SSL/TLS protocol are used. Since the POODLE attack in + 2014, all SSL protocols are considered unsafe and a secure setting for + this attribute in a standalone Tomcat setup might be + sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"

The tomcatAuthentication attribute is used with the AJP connectors to determine if Tomcat should authenticate the user or if diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml index 8353399..52d09e4 100644 --- a/webapps/docs/ssl-howto.xml +++ b/webapps/docs/ssl-howto.xml @@ -25,7 +25,8 @@ Christopher Cain Yoav Shapira - SSL Configuration HOW-TO + Glen Peterson + SSL/TLS Configuration HOW-TO @@ -42,7 +43,7 @@ directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME, the directory into which you have installed Tomcat.

-

To install and configure SSL support on Tomcat, you need to follow +

To install and configure SSL/TLS support on Tomcat, you need to follow these simple steps. For more information, read the rest of this HOW-TO.

  1. Create a keystore file to store the server's private key and @@ -63,15 +64,16 @@ self-signed certificate by executing the following command:

    -
    +
    -

    SSL, or Secure Socket Layer, is a technology which allows web browsers and -web servers to communicate over a secured connection. This means that the data -being sent is encrypted by one side, transmitted, then decrypted by the other -side before processing. This is a two-way process, meaning that both the -server AND the browser encrypt all traffic before sending out data.

    +

    Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer +(SSL), are technologies which allow web browsers and web servers to communicate +over a secured connection. This means that the data being sent is encrypted by +one side, transmitted, then decrypted by the other side before processing. +This is a two-way process, meaning that both the server AND the browser encrypt +all traffic before sending out data.

    -

    Another important aspect of the SSL protocol is Authentication. This means +

    Another important aspect of the TLS protocol is Authentication. This means that during your initial attempt to communicate with a web server over a secure connection, that server will present your web browser with a set of credentials, in the form of a "Certificate", as proof the site is who and what @@ -83,11 +85,13 @@ users. Most SSL-enabled web servers do not request Client Authentication.

    -
    +

    It is important to note that configuring Tomcat to take advantage of secure sockets is usually only necessary when running it as a stand-alone -web server. When running Tomcat primarily as a Servlet/JSP container behind +web server. Details can be found in the +Security Considerations Document. +When running Tomcat primarily as a Servlet/JSP container behind another web server, such as Apache or Microsoft IIS, it is usually necessary to configure the primary web server to handle the SSL connections from users. Typically, this server will negotiate all SSL-related functionality, then