0

(I have asked the same question in stackoverflow as well.)

I am trying to install an SSL certificate in a tomcat server (linux based server). This is a godaddy certificate. Installation is proper and when I check the website with https, it shows the cert is valid, but with some other error:

in chrome: ERR_SSL_VERSION_OR_CIPHER_MISMATCH (The client and server don't support a common SSL protocol version or cipher suite. This is likely to be caused when the server needs RC4, which is no longer considered secure.)
in FireFox: SSL_ERROR_NO_CYPHER_OVERLAP

My server.xml now:

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" keystoreFile="/etc/tomcat7/mykeystore" keystorePass="password" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA "/>

Tried googling and implementing almost all the results I found, but not expected result. Can someone please help me at the earliest.?

Many thanks in advance.

serverstackqns
  • 722
  • 2
  • 16
  • 39

1 Answers1

1

The cipher list is broken, you have the same list repeated several times.

Check the Tomcat wiki for the right syntax, and check the Mozilla wiki for the ciphers suites you should be using.

You can try

openssl s_client -connect yoursite:443

to see what's being negotiated, cipher lists specifically. You can also use the tools in this repository to perform a more detailed analysis.

dawud
  • 14,918
  • 3
  • 41
  • 61