如何在wso2product上将TLS 1.0升级到TLS 1.2

Question

We are trying to upgrade TLS 1.0 to TLS 1.2 version in the WSO2 BPS.Following procedure for upgrading TLS latest version using this link Reference Link From WSO2 and our JAVA application is running in JDK 1.8.

1. Open the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file.

2. Removed the sslProtocol="TLS" attribute and replaced it with sslEnabledProtocols="TLSv1.2" as shown below.

 > <Connector SSLEnabled="true" port="9443" > protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" > secure="true" server="WSO2 Carbon Server" > sslEnabledProtocols="TLSv1.2" > svns:secretAlias="Server.Service.Connector.keystorePass"/> 

3. Start the server.
4. To verify that the configurations are all set correct or not we execute the following command, java -jar TestSSLServer.jar localhost 9443 and getting TLS configuration response as TLSv1.2 only,

 Supported versions: TLSv1.2 Deflate compression: no Supported cipher suites (ORDER IS NOT SIGNIFICANT): TLSv1.2 DHE_RSA_WITH_AES_128_CBC_SHA DHE_RSA_WITH_AES_256_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA256 DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ---------------------- Server certificate(s): 501fc1432d87155dc431382aeb843ed558ad61b1: CN=localhost, O=WSO2, L=Mountain View, ST=CA, C=US ---------------------- Minimal encryption strength: strong encryption (96-bit or more) Achievable encryption strength: strong encryption (96-bit or more) BEAST status: protected CRIME status: protected 

5. But when we captured the pcap file and in Wireshark it is showing like TLSv1.0 still as shown below:

Updated:

We have changed jre/lib/security/java.security as per @user7294900 instruction. when we set configuration in that java.security file, we are facing this error message in wso2BPMN. But we can able to view TLS version 1.2 in Wireshark capture with a handshake failure notification.

Wso2BPMN,

Caused by: org.apache.commons.mail.EmailException: Sending the email to the following server failed : smtp.office365.com:587
at org.apache.commons.mail.Email.sendMimeMessage(Email.java:1398)
at org.apache.commons.mail.Email.send(Email.java:1423)
at org.activiti.engine.impl.bpmn.behavior.MailActivityBehavior.execute(MailActivityBehavior.java:102)
... 192 more
Caused by: javax.mail.MessagingException: Can't send command to SMTP host;
  nested exception is:
javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
at com.sun.mail.smtp.SMTPTransport.sendCommand(SMTPTransport.java:1420)
at com.sun.mail.smtp.SMTPTransport.sendCommand(SMTPTransport.java:1408)
at com.sun.mail.smtp.SMTPTransport.ehlo(SMTPTransport.java:847)
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:384)
at javax.mail.Service.connect(Service.java:297)
at javax.mail.Service.connect(Service.java:156)
at javax.mail.Service.connect(Service.java:105)
at javax.mail.Transport.send0(Transport.java:168)
at javax.mail.Transport.send(Transport.java:98)
at org.apache.commons.mail.Email.sendMimeMessage(Email.java:1388)
... 194 more

So, is there any configuration required for TLSv1.2 version upgrade.

Answer 1

You need to disable TLS below 1.2

set the

  jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1 

in the file jre/lib/security/java.security on the server.

Also try to reduce your ciphers as @Dimtri suggested

set ciphers that are supported only by TLSv1.2

 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 

Answer 2

WSO2 opens many random ports. You can try disabling TLSv1 and TLSv1.1 in java.security. Set below:

jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1

in the file

<PRODUCT_HOME>/jre/lib/security/java.security.

I tried this for Identity server. You can give it a try for BPS.