I've inherited a small secure web application that runs on a single Tomcat 6 web server on a machine running Amazon Linux. I need to disable the SSLv3 fallback, but I just can't find where the HTTPS configuration is located (e.g. path to the pem file etc.)
The config files at /usr/share/tomcat6/conf/server.xml
and /etc/tomcat6/server.xml
(which are both identical) have the following (what looks like default) setup:
<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
<Engine name="Catalina" defaultHost="localhost">
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
<Context path="" docBase="/var/www/" debug="1" reloadable="true" override="true" allowLinking="true" />
<Valve className="org.apache.catalina.valves.RemoteIpValve" protocolHeader="X-Forwarded-Proto" />
</Host>
</Engine>
</Service>
My understanding is that there should be additional configuration here with details of the SSL cert etc. Is there somewhere else this stuff can be configured? If not, why does the server handle HTTPS requests successfully?