I've setup a Spring Framework 5 project working very well so far. Needed to enable HTTPS for some functionality so followed a tutorial. Currently generated the certificate and key on the server with the following command:
keytool -genkeypair -alias tomcat -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -validity 365000
I've then imported this keystore into my resources folder and used the following properties:
server.ssl.key-store= classpath:keystore.p12server.ssl.key-store-password= myPasswordserver.ssl.key-store-type= PKCS12server.ssl.key-alias= tomcatserver.port= 8444
I've also setup a redirect from HTTP to HTTPS with the following configuration:
@Beanpublic ServletWebServerFactory servletContainer() { TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() { @Override protected void postProcessContext(Context context) { SecurityConstraint securityConstraint = new SecurityConstraint(); securityConstraint.setUserConstraint("CONFIDENTIAL"); SecurityCollection collection = new SecurityCollection(); collection.addPattern("/*"); securityConstraint.addCollection(collection); context.addConstraint(securityConstraint); } }; tomcat.addAdditionalTomcatConnectors(redirectConnector()); return tomcat;}private Connector redirectConnector() { Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol"); connector.setScheme("http"); connector.setPort(8182); connector.setSecure(false); connector.setRedirectPort(8444); return connector;}
When running locally from my IDE or by running the compiled .jar it works fine. However when I try to run it on my server (a locally running Synology NAS that previously worked fine) I get errors when trying to reach the address (https://192.168.10.10:8444
) with the following error on Firefox: SSL_ERROR_NO_CYPHER_OVERLAP
and on chrome ERR_SSL_VERSION_OR_CIPHER_MISMATCH
. I've looked for answers but I have not found any solutions that changed the outcome of this problem.
Available JDK CIPHERs on the server:
Default Cipher SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA* SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA* SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA SSL_DH_anon_WITH_3DES_EDE_CBC_SHA SSL_DH_anon_WITH_DES_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA* SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_RSA_WITH_NULL_MD5 SSL_RSA_WITH_NULL_SHA* TLS_DHE_DSS_WITH_AES_128_CBC_SHA* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256* TLS_DHE_DSS_WITH_AES_256_CBC_SHA* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384* TLS_DHE_RSA_WITH_AES_128_CBC_SHA* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256* TLS_DHE_RSA_WITH_AES_256_CBC_SHA* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DH_anon_WITH_AES_128_CBC_SHA TLS_DH_anon_WITH_AES_128_CBC_SHA256 TLS_DH_anon_WITH_AES_128_GCM_SHA256 TLS_DH_anon_WITH_AES_256_CBC_SHA TLS_DH_anon_WITH_AES_256_CBC_SHA256 TLS_DH_anon_WITH_AES_256_GCM_SHA384* TLS_EMPTY_RENEGOTIATION_INFO_SCSV TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA TLS_KRB5_WITH_3DES_EDE_CBC_MD5 TLS_KRB5_WITH_3DES_EDE_CBC_SHA TLS_KRB5_WITH_DES_CBC_MD5 TLS_KRB5_WITH_DES_CBC_SHA* TLS_RSA_WITH_AES_128_CBC_SHA* TLS_RSA_WITH_AES_128_CBC_SHA256* TLS_RSA_WITH_AES_128_GCM_SHA256* TLS_RSA_WITH_AES_256_CBC_SHA* TLS_RSA_WITH_AES_256_CBC_SHA256* TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_NULL_SHA256
My openSSL s_client connect output:
No client certificate CA names sentPeer signing digest: SHA256Peer signature type: RSAServer Temp Key: DH, 1024 bits---SSL handshake has read 1601 bytes and written 505 bytesVerification error: self signed certificate---New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384Server public key is 2048 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1.2 Cipher : DHE-RSA-AES256-GCM-SHA384 Session-ID: 5B9B776C430F2AEF917BAE78C14F78CDC6DB2F0ED7284E66EFAF9688319F46B2 Session-ID-ctx: Master-Key: FBA675AEDE7EB03926991415E6760249DE82E4967EC7A724D04C1D8FEFC2C3CC37DFC84ACD29607CAF88775EBBD6E519 PSK identity: None PSK identity hint: None SRP username: None Start Time: 1536915308 Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) Extended master secret: no---