如何在Java 7和OpenShift应用程序之间建立HTTPS连接？

Question

OpenShift swiftly addressed the SSL 'Poodle' vulnerability around October 16th 2014. Since then the e-commerce provider I work with can no longer establish a secure HTTPS connection with my OpenShift PHP application. I suspect this is, at least in part, because SSL3 is no longer an available protocol.

The error logged at the e-commerce provider end is:

javax.net.ssl.SSLException
java.lang.RuntimeException: Could not generate DH keypair

Here's what I've tried and discovered so far:

The online SSL testing tool at https://www.ssllabs.com/ssltest/ indicates my SSL Certificate is installed correctly (installed via the OpenShift WebConsole), and it receives an 'A' grade. HTTPS works fine when connecting to my OpenShift PHP application in a normal web browser. In general the SSL Certificate & installation itself seems fine.

As a test, I have tried using OpenShift's shared SSL Certificate instead of my own, with exactly the same result.

Java 7

The remote e-commerce platform that is attempting to connect to my OpenShift PHP app via HTTPS uses Java 7. Tech support thinks the issue is that their Java 7 system doesn't support cipher key lengths > 1024 bits. Unfortunately they're not in a position to upgrade their system to Java 8 at present, so their hands are a bit tied.

Handshake Simulation

The ssllabs analysis of my SSL Certficate includes a useful Handshake Simulation test with various clients. This actually shows a Java 7 simulation connecting OK using TLS1.0, however the Java 6 simulation fails with a 'Client does not support DH parameters > 1024 bits' error - roughly echoing what e-commerce tech support is seeing reported by their Java 7 based system.

How might I solve this? To narrow the question down a little:

Is there a simple adjustment my e-commerce provider could make at their end to enable HTTPS connections to OpenShift applications, without them having to upgrade Java or make significant changes that could impact others? eg An option to accept DH parameters > 1024 bits.

Is there anything I can adjust at my end (perhaps an OpenShift or PHP setting) to enable their Java 7 based system to establish a HTTPS connection with my OpenShift application successfully? eg An option instructing OpenShift to provide DH parameters <= 1024 bits.

Answer 1

Restarting your application should resolve the issue as it will pick up the latest JDK that should contain the latest fixes for this issue.

https://bugzilla.redhat.com/show_bug.cgi?id=1035818
https://bugzilla.redhat.com/show_bug.cgi?id=1080125