如许多地方所述,我无法在Tomcat中禁用弱SSL密码,例如http://www.techstacks.com/howto/secure-ssl-in-tomcat.html。 目前,我的连接器如下所示:
..Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA" clientAuth="false" sslProtocol="TLS" keystoreFile="C:\Programs\apache-tomcat-6.0.33\keystore" keystorePass="nn"/>
当我尝试连接(使用IE或ssldigger)时, 在Tomcat中出现以下错误:
java.lang.IllegalArgumentException: Unsupported ciphersuite SSL_RSA_WITH_RC4_128_SHA at com.sun.net.ssl.internal.ssl.CipherSuite.valueOf(Unknown Source) at com.sun.net.ssl.internal.ssl.CipherSuiteList.<init>(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.setEnabledCipherSuites(Unknown Source) at org.apache.tomcat.util.net.NioEndpoint.createSSLEngine(NioEndpoint.java:1141) at org.apache.tomcat.util.net.NioEndpoint.setSocketOptions(NioEndpoint.java:1096) at org.apache.tomcat.util.net.NioEndpoint$Acceptor.run(NioEndpoint.java:1315) at java.lang.Thread.run(Unknown Source)
顺便说一句,我删除了不支持的密码(几乎一个接一个),剩下的唯一一个似乎受支持的 密码是SSL_RSA_WITH_RC4_128_MD5
另外,我假设不受支持的密码与Tomcats的特定密钥对无关,而与更广泛的可用密码有关。
怎么了
我想通了..逗号分隔的密码列表对空格敏感, 即元凶是逗号后的空格字符